backend-setup-wizard
Warn
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: MEDIUMPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill fetches documentation from external websites and is instructed to follow those steps to perform setup tasks. This exposes the agent to indirect prompt injection, where instructions embedded in a web page could override the skill's logic or compromise the system.
- Ingestion points: Web-search results and fetched documentation pages (SKILL.md).
- Boundary markers: Absent. The skill lacks instructions to ignore or delimit potentially malicious commands within the fetched documentation.
- Capability inventory: Command execution (CLI provisioning), file writing (.env), and network operations.
- Sanitization: Absent. The skill directs the agent to "follow the exact steps" extracted from the web.
- [REMOTE_CODE_EXECUTION]: The skill is designed to install CLI tools and execute setup commands based on instructions retrieved from the internet at runtime, which is functionally equivalent to remote code execution from unverified sources.
- Evidence: Step 5 instructions to install CLI tools and execute commands found in documentation fetched during the session.
- [COMMAND_EXECUTION]: The agent executes arbitrary terminal commands to provision and configure services, including project linking and migration commands, which can be manipulated by untrusted external content.
- Evidence: Step 5 provides broad authority to execute terminal commands (init, login, schema migrations) based on external documentation.
- [DATA_EXFILTRATION]: The skill requests live production API keys and tokens from the user. While it mandates storing them in a .env file, the active solicitation of production-level secrets into the chat context presents a risk of exposure.
- Evidence: The "Always use real, live credentials" section explicitly directs the agent to collect and configure production keys rather than test or sandbox keys.
- [EXTERNAL_DOWNLOADS]: The skill performs web searches and fetches the content of remote pages to determine its next actions.
- Evidence: Step 3 and Step 5 require the agent to fetch documentation pages from the web to extract setup steps.
Audit Metadata