soia-dev-agent-cli-dispatch
Warn
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_matrix.pyexecutes shell commands provided in a JSON configuration file usingsubprocess.runwithshell=True. This design facilitates arbitrary command execution on the host machine.\n- [EXTERNAL_DOWNLOADS]: The skill references an installation script for the Antigravity CLI hosted atantigravity.google. This source is associated with a well-known technology provider.\n- [PROMPT_INJECTION]: Reference files for various CLIs (Codex, Claude Code, Gemini, qodercli) explicitly instruct the agent to use flags that disable safety filters or bypass user approval prompts, such as--dangerously-bypass-approvals-and-sandbox,--yolo, and--dangerously-skip-permissions.\n- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates vulnerability to indirect prompt injection due to its processing of external tool outputs.\n - Ingestion points: Output from external CLI processes is captured and stored in manifest files by
scripts/run_matrix.py.\n - Boundary markers: The scripts do not implement boundary markers or instructions to ignore embedded commands when handling data from external sources.\n
- Capability inventory: The skill possesses the capability to execute shell commands and perform filesystem writes.\n
- Sanitization: While
scripts/run_claude_prompt.pyuses stdin to pass data to the Claude CLI, no systematic sanitization is applied to the outputs received from external tools before they are recorded or potentially processed in subsequent turns.
Audit Metadata