shellcheck
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill includes instructions to install the Shellcheck utility using
sudoviaapt-getorsnap. It also suggests installing the binary directly into/usr/local/bin, a system-level directory.\n- [EXTERNAL_DOWNLOADS]: The skill provides a command to download the latest Shellcheck release directly from the official GitHub repository (api.github.com/repos/koalaman/shellcheck).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests shell scripts from the project environment to perform validation, which could allow malicious content within those scripts to influence the agent's behavior.\n - Ingestion points: Shell scripts (
*.sh) found in the project directory.\n - Boundary markers: The skill does not implement specific delimiters or safety instructions to prevent the agent from following directions embedded in script comments.\n
- Capability inventory: The skill uses
findto discover files andshellcheckto process them.\n - Sanitization: No sanitization or filtering is applied to the script content before it is processed for validation.\n- [COMMAND_EXECUTION]: The skill executes the
shellcheckbinary on files detected within the project workspace.
Audit Metadata