Skills
skills/pskoett/pskoett-ai-skills/skill-tester-ci/Gen Agent Trust Hub

skill-tester-ci

Warn

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/run-tests.sh is vulnerable to command injection. It takes the first command-line argument and interpolates it into a Python command executed via python3 -c without escaping, allowing for arbitrary code execution if a crafted argument is provided.
  • [COMMAND_EXECUTION]: The testing script processes markdown files from other skills by extracting code blocks and writing them to temporary files. The lack of content validation or source verification creates a surface for injection attacks if the local repository contains malicious skill definitions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 11, 2026, 12:13 PM