math-help
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous instructions for the agent to execute shell commands using
uv run pythonto run local mathematical utility scripts.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where untrusted user input (mathematical formulas) is interpolated into shell command arguments. This poses a risk of command injection if the agent or scripts fail to sanitize the input.\n - Ingestion points: Multiple templates in
SKILL.mdthat accept user expressions as string arguments for Python scripts.\n - Boundary markers: Absent; no delimiters or ignore-instructions are specified for the user-provided math content.\n
- Capability inventory: Shell execution capabilities for multiple scripts in the
scripts/andscripts/cc_math/paths.\n - Sanitization: The documentation lacks instructions for escaping or validating user-supplied strings before they are executed in a shell context.
Audit Metadata