trailmark-structural
Warn
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The shell command in Step 2 (
find {args} -type f ...) interpolates the user-provided{args}variable without shell-safe quoting. This allows an attacker to execute arbitrary shell commands by supplying a path containing metacharacters (e.g.,; rm -rf /).\n- [COMMAND_EXECUTION]: The shell command in Step 3 (trailmark analyze ... {language_flag} {args}) also interpolates{args}without quoting. This provides an additional vector for command injection, allowing arbitrary code execution with the permissions of the agent process.
Audit Metadata