pave-recon
Warn
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions in Step 2 of SKILL.md direct the agent to search for and inventory sensitive configuration files and environment variable management systems, specifically mentioning .env files and secret managers. Accessing these files poses a risk of exposing credentials or sensitive environment configuration details to the agent and potentially to the reporting stage.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it is designed to ingest and process untrusted data from the local project filesystem.
- Ingestion points: The agent is instructed to read various project configuration files (Steps 0, 1, 3, 4 in SKILL.md) including Makefile, docker-compose.yml, nx.json, and package manifests using the Read and Bash tools.
- Boundary markers: No instructions or delimiters are provided to the agent to distinguish between its core instructions and potentially malicious instructions embedded within the analyzed files.
- Capability inventory: The skill possesses broad capabilities, including the Bash tool for command execution and WebFetch for network requests, which could be abused if the agent encounters and obeys malicious content in the files it inventories.
- Sanitization: The instructions contain no provisions for sanitizing or validating the contents of the files before they are processed by the agent.
Audit Metadata