forge-supply-chain

Warn

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js script located at a relative path outside the skill's directory: node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js supply-chain compose --root <repository-root> --json. Executing scripts from relative paths in the workspace poses a risk if the workspace contains untrusted or malicious files.
  • [COMMAND_EXECUTION]: The execution command includes parameters such as --root, --request, --condition, and --risk-surface. If these parameters are populated with unvalidated user input, it could lead to command argument injection.
  • [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by requiring the agent to load and follow instructions from external files (.forge/composition.json and a canonical playbook at ../../../.fullstack-forge/skills/forge-supply-chain/SKILL.md).
  • Ingestion points: SKILL.md (via relative path traversal) and .forge/composition.json (determining which paths to load).
  • Boundary markers: None are specified to protect the agent from malicious instructions embedded in these external sources.
  • Capability inventory: The skill has the capability to execute shell commands via Node.js and read arbitrary files via relative path traversal.
  • Sanitization: There is no evidence of sanitization or validation performed on the external content before it is processed as instructions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 6, 2026, 06:48 PM
Security Audit — agent-trust-hub — forge-supply-chain