grep-login
Fail
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to execute shell commands that incorporate user-provided data without any sanitization or escaping. This allows for arbitrary command execution if a user provides a malicious input containing shell metacharacters.\n
- Evidence: In
SKILL.md, the instructionnode \"${SCRIPTS_DIR}/auth.js\" set-api-key \"<api_key>\"uses raw user input for the API key.\n - Evidence: In
SKILL.md, the instructionsnode \"${SCRIPTS_DIR}/auth.js\" enchanted-send \"<email>\"andnode \"${SCRIPTS_DIR}/auth.js\" verify \"<email>\" \"<code>\"use raw user input for email and OTP codes.\n - Evidence: In
SKILL.md, the instructionnode \"${SCRIPTS_DIR}/billing.js\" redeem \"<code>\"uses raw user input for promo codes.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a large attack surface by processing multiple pieces of untrusted external data and feeding them into high-privilege capabilities without boundary markers or sanitization steps.\n - Ingestion points: User responses to
AskUserQuestionfor authentication and billing steps.\n - Boundary markers: None present in the instructions to delimit user input from shell command structures.\n
- Capability inventory: Shell command execution via
nodeandbash.\n - Sanitization: No sanitization, escaping, or validation logic is specified for any user-provided inputs.
Recommendations
- AI detected serious security threats
Audit Metadata