xy-sync
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches a remote
UPDATE.jsonfile viacurland interpolates thenoticefield directly into the agent's output. An attacker who controls the update server could provide a malicious notice containing instructions to manipulate the agent's behavior. - Ingestion point:
scripts/xy-sync.sh(cmd_check_remote function) - Boundary markers: None present for the notice text.
- Capability inventory: The skill has extensive command execution capabilities (bash scripts, git, python).
- Sanitization: None. The raw notice string is echoed.
- [COMMAND_EXECUTION]: The skill's primary function involves executing multiple shell scripts and git commands to synchronize files and manage repositories.
- [EXTERNAL_DOWNLOADS]: The
check-remotecommand performs network requests to an external URL (defined in configuration or environment variables) to check for updates. - [DYNAMIC_EXECUTION]: The skill executes a local Python script (
tools/build_atoms.py) and uses inline Python snippets for JSON processing.
Audit Metadata