lore-query
Warn
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to build and run shell commands (
git log) using user-provided arguments for<trailer>and<path>. Specifically, it states that unrecognized names should be treated as custom trailers and queried "as-is". If the agent does not sanitize these inputs, a user could provide a malicious string (e.g.,"; touch /tmp/pwned #) to execute arbitrary shell commands. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Git commit history (trailers and messages) and processes it for display. There is a surface for indirect prompt injection if commit messages contain instructions designed to manipulate the agent during the parsing or formatting phase.
- Ingestion points: Git commit history (summaries and trailers) via the
git logcommand. - Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore instructions embedded within the commit history.
- Capability inventory: Shell command execution (
git log). - Sanitization: Absent. There are no instructions for escaping shell arguments or sanitizing the content of the commit history before displaying it.
Audit Metadata