add-scene-warmup
Fail
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves code components, source files, and integration instructions from an external source via the
threenixMCP server using theget_component_referencetool.\n- [REMOTE_CODE_EXECUTION]: The instructions direct the agent to fetch remote content, write it to the filesystem, and then perform build and runtime checks, which effectively executes code from a non-trusted external source.\n- [COMMAND_EXECUTION]: The workflow requires the agent to execute shell commands for package installation and running build/runtime verification scripts.\n- [DYNAMIC_EXECUTION]: The skill involves generating source files from Base64-encoded strings retrieved at runtime and then executing them as part of the application build process.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external API, creating a vulnerability surface where malicious instructions could be embedded in the fetched components.\n - Ingestion points: The
files[]array andintegrationNotesreturned by thethreenixMCP server.\n - Boundary markers: Absent. There are no delimiters or instructions to treat the external data as untrusted.\n
- Capability inventory: File system write access, package installation capabilities, and shell command execution for builds.\n
- Sanitization: Absent. The skill specifies that content should be written "verbatim" or decoded from Base64 without any validation or sanitization steps.
Recommendations
- AI detected serious security threats
Audit Metadata