compare-bundles
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute several
tuistCLI commands (tuist bundle list,tuist bundle show, andtuist bundle artifact list) to gather data for comparison. These commands are consistent with the skill's stated purpose of analyzing bundle sizes and changes. - [INDIRECT_PROMPT_INJECTION]: The skill relies on user-supplied data that is used to construct command-line arguments, which represents a potential injection vulnerability surface.
- Ingestion points: User-provided bundle IDs, dashboard URLs, and branch names mentioned in
SKILL.md. - Boundary markers: None; the instructions do not include delimiters or warnings to ignore potentially malicious content within the user-supplied strings.
- Capability inventory: The skill possesses the capability to execute shell commands via the
tuisttool. - Sanitization: There is no evidence of input sanitization, escaping, or validation being applied to the user-provided parameters before execution.
Audit Metadata