ai-prototype-flow
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill programmatically extracts OAuth access tokens by calling rclone config dump and parsing the output. This operation involves reading sensitive tool configurations that may contain credentials for multiple cloud remotes. Evidence: The scripts/export_gdoc_tab.sh file contains the command rclone config dump | jq -r '.drive.token | fromjson | .access_token'.
- [COMMAND_EXECUTION]: The workflow relies on the execution of several local shell commands to fetch, transform, and manage files. Evidence: References in SKILL.md and references/ai_prototype_flow.md to rclone, curl, and sed for document processing.
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx react-doctor@latest, which downloads and executes a package from the npm registry. Evidence: Step defined in the Phase 3 section of references/ai_prototype_flow.md.
- [PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. 1. Ingestion points: External Google Docs URLs (PRDs) fetched via curl/rclone. 2. Boundary markers: Absent; no delimiters or ignore-instructions are used for external content. 3. Capability inventory: The agent has shell access (bash), file system writes, and PR creation tools. 4. Sanitization: Absent; external document content is processed as-is. This could allow an attacker to embed malicious instructions in a PRD to control the agent.
Audit Metadata