skill-comply
Warn
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts/runner.py file executes shell commands generated by an AI model based on the content of user-provided skill files. Specifically, the _setup_sandbox function iterates over scenario.setup_commands and executes them using subprocess.run. This pattern presents a risk of arbitrary command execution if a malicious skill file tricks the generation LLM into producing dangerous setup instructions.
- [COMMAND_EXECUTION]: Multiple scripts including classifier.py, runner.py, scenario_generator.py, and spec_generator.py execute the claude CLI tool using subprocess.run to perform classification, execution, and generation tasks.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted skill and rule files and interpolating their content into LLM prompts.
- Ingestion points: scripts/spec_generator.py and scripts/scenario_generator.py read external file content from paths provided via the CLI.
- Boundary markers: Prompts in prompts/spec_generator.md and prompts/scenario_generator.md use triple-dash (---) delimiters to encapsulate the external content.
- Capability inventory: The skill can execute shell commands via subprocess.run and trigger an agent session with a broad set of allowed tools (Read, Write, Edit, Bash, Glob, Grep).
- Sanitization: No sanitization or escaping is applied to the ingested file content before it is placed in the prompts, though command execution uses shlex.split to parse the resulting commands.
Audit Metadata