compare-bundles

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions require the agent to execute several tuist CLI commands (tuist bundle list, tuist bundle show, and tuist bundle artifact list) to gather data for comparison. These commands are consistent with the skill's stated purpose of analyzing bundle sizes and changes.
  • [INDIRECT_PROMPT_INJECTION]: The skill relies on user-supplied data that is used to construct command-line arguments, which represents a potential injection vulnerability surface.
  • Ingestion points: User-provided bundle IDs, dashboard URLs, and branch names mentioned in SKILL.md.
  • Boundary markers: None; the instructions do not include delimiters or warnings to ignore potentially malicious content within the user-supplied strings.
  • Capability inventory: The skill possesses the capability to execute shell commands via the tuist tool.
  • Sanitization: There is no evidence of input sanitization, escaping, or validation being applied to the user-provided parameters before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 04:09 PM