openai-cli
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates processing external data which creates a vulnerability surface for indirect prompt injection.
- Ingestion points: The skill uses the
@prefix to read local file content (e.g.,--file @training_data.jsonl,--arg @input.txt) and shell piping (e.g.,cat document.txt | ...) to feed data into API prompts. - Boundary markers: No delimiters or protective instructions are used to separate untrusted content from system instructions in the provided examples.
- Capability inventory: The skill utilizes network access to the OpenAI API, local file system reads, and shell command execution.
- Sanitization: There is no evidence of input validation or sanitization mechanisms for the processed data.
- [CREDENTIALS_UNSAFE]: The instructions demonstrate passing the OpenAI API key and Admin key directly as command-line flags (e.g.,
--api-key sk-...). This is a security risk as flags are typically logged in plain text within shell history files. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the CLI tool from OpenAI's official GitHub repository and via the Homebrew package manager. These are recognized as trusted organizational sources.
- [COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands for tool installation (brew install, go install, git clone) and operational workflows.
Audit Metadata