Root Cause Tracing
Pass
Audited by Gen Agent Trust Hub on Jun 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a bash script
find-polluter.shthat utilizes shell commands such asfind,ls, andnpm testto automate debugging workflows. - [REMOTE_CODE_EXECUTION]: The
find-polluter.shscript performs dynamic execution of files found in the local environment, creating a surface for indirect prompt injection or malicious code execution if the target directory contains untrusted content. Ingestion points: The script reads file names and paths from the local directory via thefindcommand infind-polluter.sh. Boundary markers: Absent. The script processes files without safety delimiters. Capability inventory: The script executesnpm teston discovered files and performs directory listing withls -la. Sanitization: The script lacks validation or sanitization of discovered file paths before execution.
Audit Metadata