agent-v3-security-architect
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [OBFUSCATION]: The skill employs a consistent character substitution technique where forward slashes ('/') are replaced with dollar signs ('$') in file paths (e.g., api$auth-service.ts), package identifiers (e.g., @anthropic-ai$claude-code), and system redirections (e.g., $dev$null). This technique can be used to bypass automated security scanners that look for specific file paths or package names.
- [EXTERNAL_DOWNLOADS]: The post_execution hook invokes npx to download and execute agentic-flow@alpha, a package from an unverified source not associated with the vendor.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands within its pre_execution and post_execution hooks, including environment checks and external binary execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data through the $TASK variable.
- Ingestion points: The $TASK variable is interpolated directly into a shell command in the post_execution hook.
- Boundary markers: None present to delimit the user-provided task content.
- Capability inventory: The skill has the ability to execute shell commands and download external packages.
- Sanitization: The $TASK data is not sanitized or escaped before being used as a command-line argument, creating a potential command injection vector.
Audit Metadata