meta-long-running-build-watchdog
Fail
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
launchstep takes input directly fromuser_messageand uses it to start atmuxsession. The skill's own documentation confirms this interpolates raw user content into a shell-bound environment, enabling arbitrary command execution through shell metacharacters. - [COMMAND_EXECUTION]: The
healstep empowers asub-agentto autonomously 'apply a fix' to the system based on logs. This represents an unconstrained capability to modify the filesystem and system configuration without human review or rollback mechanisms. - [DATA_EXFILTRATION]: By allowing arbitrary shell command execution, the skill can be exploited to read sensitive files (such as
.envfiles or credentials) and exfiltrate them via network tools available in the shell environment. - [PROMPT_INJECTION]: The design involves interpolating untrusted user data (
user_message) directly into task instructions for a sub-agent. This is a classic injection surface where an attacker can craft a message to redirect the agent's behavior or bypass intended constraints.
Recommendations
- AI detected serious security threats
Audit Metadata