write-script-mysql
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions specify that an agent should follow a
prompt_for_aistring found within a script's input schema (external YAML/JSON data). This creates a surface where third-party script authors could embed malicious instructions that influence the agent's choice of inputs or parameters. - Ingestion points: The
prompt_for_aifield located in.script.yamlfiles or script schemas. - Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when processing this field.
- Capability inventory: The agent is authorized to execute code via
wmill script previewand deploy changes viawmill sync push. - Sanitization: There is no requirement mentioned for sanitizing or validating the content of the
prompt_for_aifield before the agent follows its instructions. - [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using the
wmillCLI directly (e.g.,wmill script preview,wmill generate-metadata). The instructions explicitly state that the agent should run these commands themselves ("YOU run the command, not the user") and pick "plausible args," which increases the agent's autonomy and potential impact of unintended command execution.
Audit Metadata