setup-experiment
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the required 'tpc' CLI by piping a remote script to bash using the command
curl -fsSL https://cli.promptingco.com/install.sh | bash. This script is hosted on the author's official domain ('promptingco.com') and is used for initial environment setup. - [COMMAND_EXECUTION]: The skill uses the 'tpc' CLI to perform legitimate operations such as listing tasks and environments, switching product contexts, and creating experiments. These commands are necessary for the skill's stated purpose.
- [PROMPT_INJECTION]: The skill contains a workflow that fetches documentation from user-provided URLs to suggest experimental tasks, which presents an indirect prompt injection surface.
- Ingestion points: External documentation fetched from remote URLs in 'workflows/setup-experiment.md'.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded instructions in the fetched content.
- Capability inventory: The skill has the capability to create and configure tasks and experiments using the 'tpc' CLI.
- Sanitization: No specific sanitization or filtering of the documentation content is mentioned before it is processed by the agent.
Audit Metadata