relay-audit
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute reconnaissance commands (
ls -a) and read various configuration files (cat .github/workflows/*.yml,.gitlab-ci.yml,Jenkinsfile, etc.) to perform its primary function of auditing the pipeline. - [PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it ingests untrusted data from external configuration files into the agent's context.
- Ingestion points: Files like
.github/workflows/*.yml,.gitlab-ci.yml, andJenkinsfileare read usingcatin SKILL.md (Step 1). - Boundary markers: None; the content of these files is added directly to the agent's context without delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill allows use of
Bash,WebFetch, andWebSearchtools, which could potentially be triggered by malicious instructions inside the audited files. - Sanitization: There is no filtering or escaping of the content read from the local filesystem before the agent processes it.
Audit Metadata