work-summary
Fail
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs shell commands by directly interpolating user-supplied arguments for repository paths, author names, and date ranges. This pattern is vulnerable to command injection, allowing an attacker to execute arbitrary shell commands by providing input containing shell metacharacters.\n
- Evidence:
cd <repo> && git log --author="<author>" --since="<start>" --until="<end>"inSKILL.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of git commit messages and instructs the agent to analyze and categorize them. This creates a surface where malicious commit messages could influence or override the agent's behavior.\n - Ingestion points: Git commit history logs retrieved from specified repositories.\n
- Boundary markers: None present to distinguish commit data from instructions.\n
- Capability inventory: Shell command execution via git and bash; file system write access.\n
- Sanitization: No sanitization or filtering of commit messages before processing by the LLM.\n- [DATA_EXFILTRATION]: The skill generates a summary of work accomplishments and writes it to a common directory (
/tmp), which may expose sensitive information about code changes and project activity to other users on the same system.\n - Evidence: Instruction to
Create a self-contained HTML report at /tmp/work-summary.htmlinSKILL.md.
Recommendations
- AI detected serious security threats
Audit Metadata