forge-privacy
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute the command
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js. This allows the execution of arbitrary logic from a file located outside the skill's own directory. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by instructing the agent to dynamically ingest instructions from a 'canonical playbook' and paths specified in a configuration file.
- Ingestion points: Instructions are read from
../../../.fullstack-forge/skills/forge-privacy/SKILL.mdand the.forge/composition.jsonfile. - Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious directions within these external files.
- Capability inventory: The agent is granted the capability to execute shell commands (via
node) and read local files. - Sanitization: The skill does not implement any validation or sanitization of the content retrieved from external sources before processing it as instruction.
Audit Metadata