food-pipeline
Warn
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, specifically "python3 scripts/privacy_scan.py " in "references/quality-gates.md" and "pandoc" in "SKILL.md". The instruction "python3 scripts/privacy_scan.py " does not include proper quoting for the filename variable, which could lead to command injection if the user provides a maliciously crafted filename.
- [PROMPT_INJECTION]: The skill includes deceptive metadata in the "SKILL.md" frontmatter, specifically "verified: 2026-07". This future date appears intended to misrepresent the skill as having undergone a formal security audit or verification process.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection attack surface by processing untrusted user data (topics, datasets, and drafts) and feeding it into a workflow that utilizes shell execution capabilities.
- Ingestion points: "agents/intake_router.md" specifies that the agent should ingest user-provided topics, datasets, and drafts.
- Boundary markers: No technical delimiters or instructions to ignore embedded instructions within user data are provided.
- Capability inventory: The skill utilizes shell commands ("pandoc", "python3") as documented in "SKILL.md" and "references/quality-gates.md".
- Sanitization: The "privacy_scan.py" script is intended for sanitization, but it is executed via shell and its internal logic is unverifiable.
Audit Metadata