Skills
Navigate
skills/paradevai/paradev/standup/Gen Agent Trust Hub

standup

Fail

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a bash script (scripts/sweep.sh) and the superset CLI to list workspaces and read terminal session data.
  • [REMOTE_CODE_EXECUTION]: The script scripts/sweep.sh contains a diagnostic message that suggests installing the vendor's CLI tool using a piped shell command: curl -fsSL https://superset.sh/cli/install.sh | sh. This is a string literal intended for user instruction and is not executed by the agent automatically. The URL originates from the vendor's official domain.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted terminal output from agents which is then summarized for the user.
  • Ingestion points: scripts/sweep.sh reads terminal session content via the superset terminals read command.
  • Boundary markers: No specific delimiters or safety instructions are used to wrap the ingested terminal text in the generated report.
  • Capability inventory: The skill can execute local bash scripts, run CLI commands, and publish files to a workspace via superset pages publish.
  • Sanitization: The terminal content is not sanitized or escaped before being processed for the summary report.
Recommendations
  • HIGH: Downloads and executes remote code from: https://superset.sh/cli/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 20, 2026, 06:37 AM