directive-synthesis
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for creating custom commands that ingest untrusted user input via variables like
$1,$2, and$ARGUMENTS. - Ingestion points:
SKILL.md(Multiple sections including 'Full-Featured', 'Add Argument Handling', and 'Argument Patterns'). - Boundary markers: Absent. The templates directly interpolate variables into natural language instructions and shell commands without delimiters.
- Capability inventory: The generated commands are explicitly designed to use the
Bash,Read, andWritetools. - Sanitization: Absent. The templates do not include instruction for escaping or validating provided arguments before they are interpolated into shell contexts (e.g.,
!npm run test -- $1). - [COMMAND_EXECUTION]: The skill documents and provides templates for executing arbitrary shell commands through the platform's
Bashtool. While intended for developer productivity, the provided examples (e.g.,git,npm,jq) demonstrate a high-capability attack surface for any commands generated using these templates. - [DYNAMIC_CONTEXT_INJECTION]: The skill provides extensive documentation and examples for using the
!commandsyntax, which executes shell commands at load time. While the skill primarily serves as a tutorial/guide, the lack of sanitization logic in the provided templates could lead to command injection if generated commands process untrusted input.
Audit Metadata