cli-runner
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides structured templates for executing local CLI tools (claude, codex, agy, grok) to interface with external model providers. These commands are intended for functional model routing and session management within the agent environment.
- [INDIRECT_PROMPT_INJECTION]: The skill architecture processes untrusted input by interpolating user-provided prompts into shell command templates, creating a potential injection surface.
- Ingestion points: User prompts and external files are directly interpolated into bash command strings and redirected to stdin.
- Boundary markers: No explicit delimiters or boundary markers are defined to isolate untrusted input from the command structure.
- Capability inventory: The skill enables shell execution with capabilities that allow workspace modifications, such as permission-mode acceptEdits and sandbox workspace-write.
- Sanitization: The instructions lack specific guidance on sanitizing or escaping the interpolated content beyond standard double-quoting.
Audit Metadata