gcc

Pass

Audited by Gen Agent Trust Hub on Feb 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local initialization script located at scripts/gcc_init.sh. This script uses standard bash utilities such as mkdir and cat to create the .GCC directory structure and initial markdown files.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests data from several untrusted ingestion points including .GCC/main.md, .GCC/commit.md, and .GCC/log.md to recover context. No boundary markers or sanitization mechanisms are implemented to distinguish between legitimate historical context and potential instructions embedded in those files. A malicious actor who can modify these files could influence the agent's behavior during context recovery or cross-session resumption.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 27, 2026, 12:13 PM