blog-ki-linz
Fail
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to read sensitive API keys, including a high-privilege Supabase Service Role Key, from a hardcoded absolute file path on the local system:
/Users/martinpammesberger/.agents/config/blog-credentials.env. - [DYNAMIC_EXECUTION]: In Step 4, the skill uses
python3 -cto execute a script generated via string concatenation. This script interpolates several variables (such asDE_TITLE,DE_CONTENT, etc.) that are sourced from untrusted external data like web searches and existing database entries. This pattern is highly susceptible to code injection if the source data contains characters that break out of the Python string literal. - [COMMAND_EXECUTION]: The skill heavily relies on shell commands (
curl,bash,python3) to handle credentials, interact with APIs, and manage data payloads. These commands are executed without confirmation as part of the skill's 'fully autonomous' mode. - [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it ingests untrusted data from the web (Step 2) and from existing blog content in a Supabase database (Step 1b). This data is then used to construct payloads for subsequent execution steps without any explicit sanitization or boundary markers to prevent the agent from obeying embedded instructions.
Recommendations
- AI detected serious security threats
Audit Metadata