forge-supply-chain
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js script located at a relative path outside the skill's directory:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js supply-chain compose --root <repository-root> --json. Executing scripts from relative paths in the workspace poses a risk if the workspace contains untrusted or malicious files. - [COMMAND_EXECUTION]: The execution command includes parameters such as
--root,--request,--condition, and--risk-surface. If these parameters are populated with unvalidated user input, it could lead to command argument injection. - [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by requiring the agent to load and follow instructions from external files (
.forge/composition.jsonand a canonical playbook at../../../.fullstack-forge/skills/forge-supply-chain/SKILL.md). - Ingestion points:
SKILL.md(via relative path traversal) and.forge/composition.json(determining which paths to load). - Boundary markers: None are specified to protect the agent from malicious instructions embedded in these external sources.
- Capability inventory: The skill has the capability to execute shell commands via Node.js and read arbitrary files via relative path traversal.
- Sanitization: There is no evidence of sanitization or validation performed on the external content before it is processed as instructions.
Audit Metadata