explore-repo

Warn

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the "Bash" tool, specifically running "sqlite3" queries. It directs the agent to insert user-provided "$ARGUMENTS" into SQL queries (e.g., "WHERE path LIKE '%';"), which creates a SQL injection vulnerability if the input contains malicious SQL or shell metacharacters.
  • [DATA_EXFILTRATION]: The skill explicitly instructs the agent to locate and read sensitive files, including ".env*", "config/", "settings.*", and any files matching "secret". This represents a risk of exposing sensitive credentials or configuration data from the repository to the agent's context.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted content from the analyzed repository.
  • Ingestion points: Source files, configuration files, and a local SQLite database (".graph-agent/index.db") are read into the agent's context.
  • Boundary markers: The instructions lack markers or delimiters to differentiate between trusted instructions and untrusted data from the repository.
  • Capability inventory: The agent has access to "Bash" (shell execution), "Read", "Grep", and "Glob" tools.
  • Sanitization: There is no evidence of sanitization, filtering, or validation for the data ingested from the repository.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 21, 2026, 07:26 AM
Security Audit — agent-trust-hub — explore-repo