add-time-space
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates the user-provided variable
[DIRECTORY]directly into a shell command:python3 script/add_javadoc_complexity.py leetcode_java/src/main/java/LeetCodeJava/[DIRECTORY]/*.java. A lack of explicit sanitization for shell metacharacters allows for potential command injection if a malicious directory name is provided. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes external Java source files, which could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: Java files in the target directory.
- Boundary markers: None present to distinguish code from potential malicious instructions.
- Capability inventory: The skill has access to
Bash,Edit,Read,Glob, andGreptools. - Sanitization: Basic input validation for directory names is suggested, but no sanitization is performed on the content of the files being processed.
Audit Metadata