forge-queries
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script using path traversal:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js. It also directs the agent to load and follow paths listed in a dynamically generated.forge/composition.jsonfile. These patterns allow for the execution of code and loading of instructions from outside the skill's package.\n- [PROMPT_INJECTION]: The skill contains a directive to "Read the canonical playbook now and follow it exactly" from a relative path (../../../.fullstack-forge/skills/forge-queries/SKILL.md), effectively redirecting the agent's behavior to an external file. This setup involves an indirect prompt injection surface:\n - Ingestion points: Files within the repository path provided to
--root, the canonical SKILL.md file, and thecomposition.jsonfile.\n - Boundary markers: None identified; instructions command strict adherence to external content.\n
- Capability inventory: Ability to execute Node.js scripts and read files across the filesystem via relative paths.\n
- Sanitization: No evidence of input validation or escaping for the repository paths or file contents.
Audit Metadata