forge-auth
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script at a relative path:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js. This script is used to perform a "runtime composition" which determines how the skill behaves. - [PROMPT_INJECTION]: The skill identifies itself as an "adapter" that loads its primary instructions (the "canonical playbook") from an external file at
../../../.fullstack-forge/skills/forge-auth/SKILL.md. It also loads specialist guidance from paths listed in.forge/composition.json. This architecture creates a surface for indirect prompt injection if an attacker can influence the contents of these files within the repository. - Ingestion points:
../../../.fullstack-forge/skills/forge-auth/SKILL.mdand.forge/composition.jsonrelative to the repository root. - Boundary markers: Absent. The agent is told to "follow it exactly."
- Capability inventory: The skill possesses the ability to execute Node.js scripts and read files throughout the repository structure via relative path traversal.
- Sanitization: No sanitization or validation of the externally loaded instructions is mentioned in the adapter code.
Audit Metadata