shell-script-quality
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Privilege Escalation (HIGH): The skill explicitly instructs the user or agent to use
sudo apt-get installfor dependency management. This grants unnecessary root access to the system during the setup phase.- Command Execution (HIGH): The skill relies on BATS for testing, which works by sourcing and executing shell scripts in the current environment. This constitutes arbitrary code execution. Additionally, it executes an unprovided scriptbash scripts/check-quality.sh, whose contents cannot be verified.- Indirect Prompt Injection (HIGH): The skill is designed to process external code which serves as the attack surface. - Ingestion points: Files processed via
shellcheck script.sh,bats tests/, andbash scripts/search.sh. - Boundary markers: None; scripts are sourced or executed directly without isolation.
- Capability inventory: Full subprocess execution, file system access, and package installation via
sudo. - Sanitization: None; the skill does not validate or sanitize the shell scripts before execution.- External Downloads (MEDIUM): The skill pulls packages from system repositories and references external GitHub Actions (
ludeeus/action-shellcheck). While these are common sources, they represent external dependencies that are not pinned to specific safe versions in the documentation.
Recommendations
- AI detected serious security threats
Audit Metadata