xy-private-ops
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local script
scripts/atoms-search.pywhich is used to search an atomic knowledge base. The agent is instructed to execute this script via a shell command (python3 ...) to retrieve operational guidelines and case studies. - [EXTERNAL_DOWNLOADS]: The helper script
atoms-search.pyperforms network operations tohttps://api.xyskill.xyz/v1/atoms/search. This is a vendor-owned API used to fetch diagnostic data. If the API is unreachable, the script fails over to a localatoms.jsonlfile. - [INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface where user-supplied keywords are interpolated into a shell command execution.
- Ingestion points: User input provided during the Phase 1 and Phase 2 diagnostics (e.g., business problems,朋友圈 keywords).
- Boundary markers: Absent. The instruction does not include specific delimiters or warnings for the shell execution context.
- Capability inventory: The skill possesses shell command execution capabilities (
python3 scripts/atoms-search.py) and network connectivity via the Python environment. - Sanitization: The skill relies on simple double-quoting of the user variable (
"<关键词>"), which provides insufficient protection against shell metacharacters or complex command injection payloads.
Audit Metadata