ecc-recipes

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash script designed for the agent to discover its own command library. It iterates through specific local directories associated with the ECC plugin (e.g., ~/.claude/plugins/marketplaces/ecc/commands) and uses safe, standard tools like find, basename, and sort to list available markdown files. User input is not used within the execution of these commands.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided workflow descriptions to suggest relevant command groups. It also reads local manifest files and command metadata to perform its mapping. This constitutes a standard and necessary data ingestion surface for the skill's intended functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 01:16 AM