explore-repo
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the "Bash" tool, specifically running "sqlite3" queries. It directs the agent to insert user-provided "$ARGUMENTS" into SQL queries (e.g., "WHERE path LIKE '%';"), which creates a SQL injection vulnerability if the input contains malicious SQL or shell metacharacters.
- [DATA_EXFILTRATION]: The skill explicitly instructs the agent to locate and read sensitive files, including ".env*", "config/", "settings.*", and any files matching "secret". This represents a risk of exposing sensitive credentials or configuration data from the repository to the agent's context.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted content from the analyzed repository.
- Ingestion points: Source files, configuration files, and a local SQLite database (".graph-agent/index.db") are read into the agent's context.
- Boundary markers: The instructions lack markers or delimiters to differentiate between trusted instructions and untrusted data from the repository.
- Capability inventory: The agent has access to "Bash" (shell execution), "Read", "Grep", and "Glob" tools.
- Sanitization: There is no evidence of sanitization, filtering, or validation for the data ingested from the repository.
Audit Metadata