oss-launch
Warn
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill explicitly directs the agent to execute commands derived from potentially untrusted external repositories. In
SKILL.md(Step 2) andreferences/readiness-checklist.md(Cold-run protocol), the agent is instructed: "If you can execute commands, do the cold run yourself in a fresh directory". This requires the agent to parse and run installation and setup scripts found in a project's README, which constitutes the dynamic execution of external code. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and analyzes untrusted data from repositories without proper boundary enforcement.
- Ingestion points: External repository content including READMEs, documentation, and source code is processed during the Interview, Step 2, and Step 3 in
SKILL.md. - Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to disregard instructions embedded within the audited project files.
- Capability inventory: The agent is directed to use shell/terminal execution capabilities to perform the "Readiness Gate" checks (Step 2).
- Sanitization: Absent. There is no evidence of content sanitization or validation before the agent executes commands or incorporates external text into its analysis.
Audit Metadata