skills/ovachiever/droid-tings/axolotl/Gen Agent Trust Hub

axolotl

Warn

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill facilitates the loading and execution of plugins and uses monkey-patching to modify software behavior at runtime, which allows for dynamic code invocation based on configuration.
  • Evidence:
  • references/api.md documents integrations.base.PluginManager for dynamic registration and loading of plugins.
  • Multiple monkeypatch modules are documented in references/api.md (e.g., monkeypatch.lora_kernels, monkeypatch.stablelm_attn_hijack_flash) to inject optimized code during execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process training datasets from external sources like local files and the Hugging Face Hub, creating a surface for malicious data to influence the agent's operations or the resulting model.
  • Evidence:
  • references/dataset-formats.md and references/other.md detail methods for importing data from varied sources including public repositories and cloud storage.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions and API support for downloading resources from external platforms, including GitHub and the Hugging Face Hub.
  • Evidence:
  • references/api.md includes the cli.utils.fetch.fetch_from_github function for syncing resources.
  • references/other.md contains installation guides that fetch code from specific Git URLs and package registries.
  • [COMMAND_EXECUTION]: The API includes functions for executing shell commands, primarily for orchestration tasks in cloud environments.
  • Evidence:
  • references/api.md documents cli.cloud.modal_.run_cmd, which executes commands within a specified folder context.
  • [REMOTE_CODE_EXECUTION]: The documentation includes examples of piping scripts to shell interpreters during installation processes.
  • Evidence:
  • references/other.md shows a command sequence python scripts/cutcrossentropy_install.py | sh to install an integration.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 18, 2026, 12:20 AM