step4-references-assets
Warn
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a shell script block intended for the agent to execute. This script automates the validation of reference images on the host file system.- [REMOTE_CODE_EXECUTION]: The validation routine uses
node -eto execute a JavaScript payload embedded within the skill's instructions. This allows the agent to perform arbitrary file system operations, such as reading JSON configuration files and traversing directories, to verify project state.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local project files to drive its verification logic, creating a surface for potential injection if those files are compromised. - Ingestion points:
projects/<project-id>/bible/characters.jsonandprojects/<project-id>/bible/locations.jsonare read and parsed at runtime. - Boundary markers: None present; the script directly parses and iterates through the JSON content.
- Capability inventory: The script utilizes file system read/list capabilities (
fs.readFileSync,fs.readdirSync), environment variable access, and process control. - Sanitization: The logic does not sanitize or validate entity IDs extracted from the JSON files before using them to construct file system paths.
Audit Metadata