4d-run
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides logic to locate and execute the
tool4dexecutable on the host system. It uses a helper script,scripts/find_tool4d.sh, which utilizes thefindcommand to resolve the path to the executable and provides templates for running it with project-specific arguments.\n- [DATA_EXFILTRATION]: The skill accesses local application data paths in~/Library/Application Support/to locate the 4D-Analyzer extension binaries. While this involves searching user directories, no network activity or exfiltration of sensitive data was identified.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external inputs like project paths and method names to construct command-line arguments. Ingestion points: Project and method parameters inSKILL.md. Boundary markers: None identified. Capability inventory: Execution of local binaries with arguments. Sanitization: No input validation or sanitization is performed on the arguments before they are used in the command execution.
Audit Metadata