enable-ssi
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to discover and execute specific commands found within local repository scripts such as
create.sh,Makefile, orjustfile. This poses a risk where an attacker-controlled file could lead the agent to run arbitrary shell commands.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and acting upon data from untrusted local files.\n - Ingestion points: Project dependency files (e.g.,
package.json,requirements.txt), Kubernetes resource metadata, and local setup scripts.\n - Boundary markers: No delimiters or safety warnings are used when processing the contents of these files.\n
- Capability inventory: The agent has access to
bash,docker, andkubectlto modify cluster state and build images.\n - Sanitization: Content read from local files is not sanitized before being used to determine the agent's actions or command arguments.\n- [COMMAND_EXECUTION]: The skill performs extensive cluster and system operations using
kubectl,docker, and standard shell utilities (grep,awk). While these are functional requirements for the skill's purpose, they provide a powerful primitive that could be abused if the agent is misled by malicious local project data.
Audit Metadata