cook-the-blog
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform several shell-based operations where user-provided placeholders (such as
[Company Name],[PATH_TO_SEO_SCRIPT], and[GIT_USER_NAME]) are directly interpolated into command strings. Without explicit sanitization requirements, this pattern is susceptible to command injection if malicious strings are provided as input. - [REMOTE_CODE_EXECUTION]: Step 7 of the workflow requires the agent to clone a repository from a user-supplied URL (
[TARGET_REPO_URL]) and executenpm install && npm run build. This triggers the execution of scripts defined in the external repository, which can lead to remote code execution if the repository is untrusted. - [DYNAMIC_EXECUTION]: The agent is directed in Step 8 to dynamically write and execute a Python script (
send_summary.py) to facilitate email notifications. This runtime generation and execution of code increases the attack surface for potential misuse. - [CREDENTIALS_UNSAFE]: The workflow requires the agent to handle sensitive secrets, including a
SERPAPI_KEYand aSENDER_APP_PASSWORD. The instructions call for these secrets to be exported into the environment or embedded in dynamically generated scripts, which can lead to accidental exposure in process logs or environment dumps. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external research sources (Tavily and SerpApi) and uses it to generate file content and influence workflow logic.
- Ingestion points: Research data from Tavily and keyword data from SerpApi are ingested in Steps 1 and 2 of
SKILL.md. - Boundary markers: The skill does not define boundary markers or instruct the agent to ignore potentially malicious instructions embedded in the external research data.
- Capability inventory: The agent has access to powerful capabilities, including shell command execution (
python3,git,npm,gsutil) and network access. - Sanitization: There is no evidence of sanitization or validation of the data retrieved from external sources before it is processed.
Audit Metadata