gemma-runner
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script scripts/run_gemma.py dynamically appends a relative path to sys.path to import the run_qwen module from a sibling directory (../qwen-runner/scripts). This execution of logic from calculated filesystem paths is a form of dynamic loading.
- [COMMAND_EXECUTION]: The skill acts as a wrapper for the qwen CLI, allowing the execution of system commands based on parameters provided to the script.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing external user input for delivery to an LLM. 1. Ingestion points: User prompts are passed as command-line arguments to scripts/run_gemma.py. 2. Boundary markers: The wrapper does not implement delimiters to isolate user prompts from instructions. 3. Capability inventory: The skill is authorized to invoke the qwen CLI tool. 4. Sanitization: No sanitization is performed on user-supplied prompt strings.
Audit Metadata