codebase-to-course
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions specify the use of
git clone <url> /tmp/<repo-name>to retrieve remote repositories. This involves executing a shell command where a user-provided URL is used as an argument. - [EXTERNAL_DOWNLOADS]: The skill fetches external content from GitHub repositories and references the Google Fonts CDN in the generated HTML output. While these are from well-known services, they involve fetching data from remote sources at runtime.
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it processes untrusted content from external codebases and has significant capabilities.
- Ingestion points: The agent reads all key files and traces data flows within a provided codebase (Phase 1 in SKILL.md).
- Boundary markers: There are no instructions or system markers defined to ensure the agent ignores malicious instructions that might be embedded in the code comments, READMEs, or data files of the analyzed codebase.
- Capability inventory: The skill can execute shell commands (
git), read the local file system, and generate/open HTML files containing JavaScript. - Sanitization: The skill lacks explicit sanitization or validation steps for the content extracted from the codebase before it is interpolated into the curriculum or the final HTML output.
Audit Metadata