tailrocks-prove
Warn
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to invoke an external TypeScript script located at a relative path outside the skill root (
../../scripts/prove-driver.ts). This script handles all machine execution tasks. - [DYNAMIC_EXECUTION]: The skill is designed to run arbitrary build commands and binaries provided by the repository under test. It also executes local adapters for application and browser testing, which involves running dynamically identified code.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository content and user feedback files (
verification/NN-feedback.md). 1. Ingestion points: Feedback files and repository source code. 2. Boundary markers: The skill includes instructions to treat repository content as evidence rather than instructions. 3. Capability inventory: Arbitrary shell command execution, filesystem writes, and git operations. 4. Sanitization: The driver uses strict JSON input and projects specific output lines to minimize exposure. - [DATA_EXFILTRATION]: The instructions require the agent to search for and identify sensitive file paths such as
.envand~/.aws/credentials. While it specifies not to copy secret values, the intentional discovery of these files poses a risk.
Audit Metadata