no-way-to-prevent-this-memory-safety
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a shell command (
go run ./cmd/no-way-to-prevent-this) to process flags and generate markdown files. - [DYNAMIC_EXECUTION]: The use of
go runinvolves compiling and executing Go source code at runtime from the skill's local directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (NVD and project websites) to populate the
-summaryflag, which is then passed to a shell command. - Ingestion points: Technical summaries and project details are fetched from external URLs provided by the user or found via web search (Workflow steps 2 and 3).
- Boundary markers: The instructions do not define delimiters or provide 'ignore embedded instructions' guidance for handling the external technical text.
- Capability inventory: The skill allows the agent to execute shell commands and write files to the
./lume/directory. - Sanitization: There are no requirements or methods specified for sanitizing or escaping the data retrieved from external sites before it is used in the command line.
Audit Metadata