compound-product

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the report files ingested by scripts/analyze-report.sh. These files are passed into the LLM context without sanitization, creating a surface where malicious instructions in reports could hijack agent behavior. \n
  • Ingestion points: Report markdown files located in the reports/ directory. \n
  • Boundary markers: None; the script interpolates raw report content directly into the analysis prompt. \n
  • Capability inventory: The autonomous agent (claude) has extensive capabilities including file system modification, shell command execution (via qualityChecks), and Git operations. \n
  • Sanitization: None; the content is passed as raw text. \n- [COMMAND_EXECUTION]: The skill utilizes the claude CLI with the --dangerously-skip-permissions flag in scripts/loop.sh and scripts/auto-compound.sh. This allows the agent to execute tools and modify files without per-step human confirmation, which increases the risk if the agent is influenced by malicious input. \n- [COMMAND_EXECUTION]: The scripts/auto-compound.sh script executes a command defined in the analyzeCommand field of compound.config.json. This provides a mechanism for arbitrary command execution if the configuration file is compromised. \n- [EXTERNAL_DOWNLOADS]: The scripts/analyze-report.sh script makes network requests to several well-known AI provider endpoints (Anthropic, OpenAI, OpenRouter, and Vercel) to analyze the product reports. \n- [SAFE]: The skill provides templates/com.compound.plist.example, which is a template for a macOS LaunchAgent. While this is a persistence mechanism, it is provided as a legitimate configuration example for users wishing to schedule the autonomous workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 08:26 PM
Security Audit — agent-trust-hub — compound-product