cco-roi
Warn
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Node.js script using the Bash tool and incorporates user-provided arguments directly into the command line line.
- Evidence: Found in
SKILL.md:node ${CLAUDE_PLUGIN_ROOT}/src/roi.js $ARGUMENTS. - Risk: Direct interpolation of user input into shell commands is a risk pattern that can lead to command injection if the input contains shell metacharacters and is not strictly validated or sanitized by the underlying system.
Audit Metadata