compound-product
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the report files ingested by
scripts/analyze-report.sh. These files are passed into the LLM context without sanitization, creating a surface where malicious instructions in reports could hijack agent behavior. \n - Ingestion points: Report markdown files located in the
reports/directory. \n - Boundary markers: None; the script interpolates raw report content directly into the analysis prompt. \n
- Capability inventory: The autonomous agent (
claude) has extensive capabilities including file system modification, shell command execution (viaqualityChecks), and Git operations. \n - Sanitization: None; the content is passed as raw text. \n- [COMMAND_EXECUTION]: The skill utilizes the
claudeCLI with the--dangerously-skip-permissionsflag inscripts/loop.shandscripts/auto-compound.sh. This allows the agent to execute tools and modify files without per-step human confirmation, which increases the risk if the agent is influenced by malicious input. \n- [COMMAND_EXECUTION]: Thescripts/auto-compound.shscript executes a command defined in theanalyzeCommandfield ofcompound.config.json. This provides a mechanism for arbitrary command execution if the configuration file is compromised. \n- [EXTERNAL_DOWNLOADS]: Thescripts/analyze-report.shscript makes network requests to several well-known AI provider endpoints (Anthropic, OpenAI, OpenRouter, and Vercel) to analyze the product reports. \n- [SAFE]: The skill providestemplates/com.compound.plist.example, which is a template for a macOS LaunchAgent. While this is a persistence mechanism, it is provided as a legitimate configuration example for users wishing to schedule the autonomous workflow.
Audit Metadata