damage-report
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's 'Advanced' section instructs the agent to execute a shell script located at a relative path:
<ai-review skill 目錄>/scripts/ai-review.sh <產出物> --rubric code|copy|research --context "<要解什麼>". This involves invoking a shell process with dynamic arguments. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where untrusted data from a previous task's output is interpolated into a command line.
- Ingestion points: The
<產出物>(work product) and<要解什麼>(task context) variables are used as command-line arguments inSKILL.md. - Boundary markers: No delimiters or instructions are provided to ensure the content is safely quoted or treated as literal data by the shell.
- Capability inventory: The skill facilitates shell execution via the external
ai-review.shscript. - Sanitization: The instructions do not mention sanitizing or escaping the task output before passing it to the script, which could lead to command injection if the output contains shell control characters like backticks, semicolons, or pipes.
Audit Metadata