perl-lint

Warn

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run perl -c for syntax validation. In the Perl language, the -c flag (compile-only) triggers the execution of code within BEGIN, CHECK, UNITCHECK, and use blocks. If the agent performs a syntax check on an untrusted or malicious Perl file, this leads to arbitrary code execution in the agent's runtime environment.- [COMMAND_EXECUTION]: The lint-perl.sh reference script and suggested shell one-liners use patterns vulnerable to command injection. The script accepts a file path via FILE="${1}" without sanitization, and the command find . -name '*.pl' | xargs perlcritic does not use null delimiters (such as -print0 and -0). This allows filenames containing spaces, semicolons, or backticks to execute unintended commands.- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the Perl::Critic and Perl::Tidy modules using the cpanm package manager. This involves fetching and installing configuration and code from the CPAN registry.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 29, 2026, 08:41 AM