forge-queries

Warn

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script using path traversal: node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js. It also directs the agent to load and follow paths listed in a dynamically generated .forge/composition.json file. These patterns allow for the execution of code and loading of instructions from outside the skill's package.\n- [PROMPT_INJECTION]: The skill contains a directive to "Read the canonical playbook now and follow it exactly" from a relative path (../../../.fullstack-forge/skills/forge-queries/SKILL.md), effectively redirecting the agent's behavior to an external file. This setup involves an indirect prompt injection surface:\n
  • Ingestion points: Files within the repository path provided to --root, the canonical SKILL.md file, and the composition.json file.\n
  • Boundary markers: None identified; instructions command strict adherence to external content.\n
  • Capability inventory: Ability to execute Node.js scripts and read files across the filesystem via relative paths.\n
  • Sanitization: No evidence of input validation or escaping for the repository paths or file contents.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 6, 2026, 06:48 PM
Security Audit — agent-trust-hub — forge-queries