mise-fy
Warn
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: MEDIUMPERSISTENCEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill provides instructions to modify user shell profile files (e.g., .zshrc, .bashrc) to enable automatic activation of the tool manager. This allows the tool's logic to be executed at the start of every new shell session. Evidence: assets/README.md and references/install.md contain instructions to append eval statements to shell configuration files.
- [REMOTE_CODE_EXECUTION]: The skill documents patterns for downloading and piping remote scripts directly into a shell interpreter for installation, specifically in continuous integration environments. Evidence: references/ci.md mentions the use of curl with a pipe to sh for mise installation.
- [COMMAND_EXECUTION]: The skill is built around defining and executing shell tasks, which enables the execution of arbitrary commands within the project environment. Evidence: SKILL.md and references/tasks.md describe the creation and execution of project tasks via the tool's run command.
- [DYNAMIC_EXECUTION]: The shell activation mechanism relies on the eval command to execute dynamically generated shell code to modify the environment at runtime. Evidence: references/install.md and assets/README.md specify the use of eval on the tool's activation output.
- [EXTERNAL_DOWNLOADS]: The skill facilitates and automates the download of various developer tools, runtimes, and binaries from external repositories and registries. Evidence: references/tools.md and references/ci.md discuss downloading tools via backends such as Aqua, GitHub, and NPM.
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest and process untrusted project configuration files (e.g., package.json, mise.toml) which could potentially contain malicious instructions. Evidence: references/mise-fy.md directs the agent to inventory existing project tools and scripts. The skill relies on the tool's built-in trust mechanism as a primary boundary marker for security. Capabilities include command execution and tool installation. Sanitization includes secret redaction features mentioned in references/env.md.
Audit Metadata