mac-code-local-ai-agent
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires cloning a code repository from an untrusted GitHub account (walter-grace/mac-code) which is not associated with the skill author.
- [REMOTE_CODE_EXECUTION]: Instructions direct the user to run multiple Python scripts (agent.py, mlx_engine.py, moe_expert_sniper.py) directly from the untrusted cloned repository, allowing for the execution of unverified external code.
- [COMMAND_EXECUTION]: The agent is designed to route user prompts to a shell tool that executes arbitrary system commands via subprocess.run(), representing a significant privilege capability.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerable attack surface for indirect prompt injection by processing external data and using it to influence agent actions.
- Ingestion points: DuckDuckGo search results (via ddgs) and shell command outputs (agent.py).
- Boundary markers: No delimiters or safety instructions are mentioned to prevent the agent from following instructions embedded in search results or command output.
- Capability inventory: Shell execution (subprocess.run), file read/write, and local network requests (requests.post).
- Sanitization: No sanitization or validation of the untrusted external data is described before it is ingested by the agent context.
Recommendations
- AI detected serious security threats
Audit Metadata