grep-domain-expert
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several internal Node.js scripts (
auth.js,grep-api.js,update-check.js) to perform authentication, API interaction, and update checks. It calculates script paths dynamically usingreadlink -fto resolve the installation directory. - [PROMPT_INJECTION]: The skill presents research reports fetched from an external API, which creates a surface for indirect prompt injection if the source content contains malicious instructions.
- Ingestion points: Research results returned from the Grep API and displayed to the user in Step 6.
- Boundary markers: None identified in the presentation instructions.
- Capability inventory: Execution of shell scripts via Node.js and file system reading.
- Sanitization: No sanitization or validation of the API-returned content is specified.
- [REMOTE_CODE_EXECUTION]: The skill uses
node -eto dynamically evaluate a JavaScript snippet for parsing JSON job identifiers from the output of the submission command.
Audit Metadata