sync-ml-reports
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads project configuration data, such as project names, workspace names, and tracking URIs, from files in the
experiments/andaudit/directories. These values are interpolated into shell commands for theskoreCLI tool. While the skill includes a confirmation step (AskUserQuestion), a malicious file could attempt to influence the agent's behavior by embedding instructions in these metadata fields. - Ingestion points: Project initialization blocks in Python files within
experiments/andaudit/directories. - Boundary markers: The skill relies on specific code patterns (e.g.,
skore.Project(...)init blocks) but does not use explicit delimiters to isolate untrusted data. - Capability inventory: Execution of
skore syncandpython -m skore_skillsvia subprocess; file system modifications (mkdir, file rewriting). - Sanitization: No explicit sanitization or validation of the extracted strings is mentioned before they are used in command-line arguments.
- [COMMAND_EXECUTION]: The skill executes several shell commands, including
skore sync,python -m skore_skills status, andpython -m skore_skills policy set. These are standard operations for the tool's intended purpose and target vendor-provided utilities.
Audit Metadata