frontend-design
Warn
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: In
SKILL.md, there is an explicit instruction for the agent to run a shell command:python .roo/skills/frontend-design/agents-skills.md. - This pattern directs the agent to invoke the Python interpreter on a file path within the skill's own directory.
- Instructing an agent to execute files as code is a high-risk pattern, especially when the file extension (.md) does not match the interpreter (python), which can sometimes be used to bypass static analysis of executable scripts (polyglots).
- If the file
.roo/skills/frontend-design/agents-skills.mdwere to be populated with malicious Python code, the agent would execute it with the privileges of the host environment.
Audit Metadata