forge-observability
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js observability compose --root <repository-root> --json. This executes a local script via a relative path traversal that reaches outside the skill's primary directory. - [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest and strictly follow instructions from an external file (
../../../.fullstack-forge/skills/forge-observability/SKILL.md) and a configuration file (.forge/composition.json). This creates a vulnerability surface where the agent's operational logic is determined by external files. - Ingestion points: The agent is instructed to read the canonical playbook and composition JSON file from the local filesystem based on relative paths.
- Boundary markers: There are no explicit delimiters or safety instructions provided to the agent to treat the external content as untrusted data.
- Capability inventory: The skill possesses command execution capabilities (using
nodeand theforgeCLI tools mentioned in the instructions). - Sanitization: No evidence of validation or sanitization of the externally loaded instructions is present.
Audit Metadata