forge-ux
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute a local Node.js script located at a relative path outside the skill's own directory:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js ux compose. This results in the execution of code that is not contained within the distributed skill package. - [COMMAND_EXECUTION]: The skill implements dynamic instruction loading. It instructs the agent to read
.forge/composition.json(generated by the aforementioned script) and load only the 'selected' paths. This causes the agent's behavior to be defined by runtime-generated content. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and acting upon untrusted data from an external configuration file.
- Ingestion points: The
selectedpaths array within.forge/composition.jsonand the output of the Node.js CLI tool. - Boundary markers: None; the agent is instructed to load and follow the paths listed in the JSON file directly without additional verification or delimiters.
- Capability inventory: Shell command execution via Node.js and file system read access for loading playbooks.
- Sanitization: No sanitization or validation of the paths or the content within the referenced JSON file is performed before loading.
Audit Metadata