structural-refactor

Warn

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: MEDIUMPRIVILEGE_ESCALATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The instructions suggest using the sudo command to manually create a symbolic link in /usr/lib/ for the libpcre library to resolve potential dependency errors on Linux systems.
  • [REMOTE_CODE_EXECUTION]: The skill provides a shell one-liner to download and execute an installation script for the comby tool directly from a Netlify-hosted domain.
  • [COMMAND_EXECUTION]: The skill defines commands to execute various command-line utilities including comby, 2to3, pyupgrade, and docker for searching and modifying source code.
  • [EXTERNAL_DOWNLOADS]: The skill directs the agent to download packages and scripts from external repositories such as PyPI, Homebrew, Cargo, and Netlify.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of user-provided source code, which represents an attack surface for indirect injection.
  • Ingestion points: The skill reads all source files in the project directory when executing search or refactoring patterns.
  • Boundary markers: No explicit markers or delimiters are used to isolate potentially adversarial content in the codebase from the agent's instructions.
  • Capability inventory: The tools possess file-write capabilities (-i in comby, -w in 2to3, and pyupgrade) to modify project files in-place.
  • Sanitization: Content is processed structurally without sanitization or validation of the input data.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 19, 2026, 05:31 AM
Security Audit — agent-trust-hub — structural-refactor