apex-takeover
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform extensive inventory of the host environment, specifically targeting infrastructure files (Dockerfiles, Kubernetes manifests, Terraform) and CI/CD configurations (.github/workflows, Jenkinsfile). This grants the agent broad visibility into the underlying system configuration.
- [DATA_EXFILTRATION]: Under the 'Warden' specialist phase, the skill explicitly instructs the agent to check for sensitive data such as .env files and hardcoded credentials. While part of a security audit, this access to local secrets combined with the available WebFetch tool establishes a risk for data exposure and potential exfiltration if the agent is misdirected.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function involves reading and summarizing contents from an inherited, potentially untrusted codebase (manifests, config files, entrypoints). Malicious instructions hidden within these files could manipulate the agent's behavior during the reconnaissance or synthesis phases.
- Ingestion points: Project manifests, configuration files, .env files, and entrypoints (SKILL.md).
- Boundary markers: Absent; the instructions do not provide delimiters or warnings to ignore embedded instructions in the analyzed data.
- Capability inventory: Access to Bash, Read, Write, WebFetch, and Task tools provides a significant attack surface if the agent obeys instructions from the data.
- Sanitization: No mention of content sanitization or validation before the data is processed or synthesized into reports.
Audit Metadata