forge-scale
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script using a relative path that traverses outside the skill's own directory:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js scale compose --root <repository-root> --json. This pattern executes code on the host system to determine the skill's runtime composition. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface by dynamically loading instructions from external files. Specifically:
- Ingestion points: The agent is directed to read a 'canonical playbook' at
../../../.fullstack-forge/skills/forge-scale/SKILL.mdand load paths specified in.forge/composition.json. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within these external files are present.
- Capability inventory: The skill possesses command execution capabilities (Node.js runtime) and file system read access.
- Sanitization: There is no evidence of validation or sanitization of the content loaded from these external configuration files or the repository root.
Audit Metadata