shunk031-research-before-implementation
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a specific shell command template using the "codex" tool and instructs the agent to execute it automatically if research stages fail.
- [DYNAMIC_EXECUTION]: The "codex exec" subcommand is used to execute prompts generated at runtime, which allows for dynamic action execution based on the results of previous research steps.
- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection:
- Ingestion points: Data is fetched from untrusted third-party documentation sites and GitHub code repositories ("SKILL.md").
- Boundary markers: The skill lacks instructions for using delimiters or warnings to ignore embedded instructions in the fetched content.
- Capability inventory: The agent is directed to "Implement and verify the change" based on the external evidence, involving file writes and configuration changes.
- Sanitization: There is no mention of sanitizing or validating the fetched external content before it influences code generation.
- [PRIVILEGE_ESCALATION]: The retry command in "SKILL.md" uses "env -u" to unset environment variables (e.g., "HERDR_ENV", "HERDR_WORKSPACE_ID", "HERDR_TAB_ID", "HERDR_PANE_ID") which may be used for context tracking or isolation. It also explicitly sets "--ask-for-approval never" to bypass standard user oversight.
- [CREDENTIALS_UNSAFE]: The instructions direct the agent to read "~/.agents/AGENTS-private.md" to retrieve "private Gateway guidance," which involves accessing environment-specific configuration files that may contain sensitive routing or proxy credentials.
Audit Metadata