perl-lint
Warn
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run
perl -cfor syntax validation. In the Perl language, the-cflag (compile-only) triggers the execution of code withinBEGIN,CHECK,UNITCHECK, anduseblocks. If the agent performs a syntax check on an untrusted or malicious Perl file, this leads to arbitrary code execution in the agent's runtime environment.- [COMMAND_EXECUTION]: Thelint-perl.shreference script and suggested shell one-liners use patterns vulnerable to command injection. The script accepts a file path viaFILE="${1}"without sanitization, and the commandfind . -name '*.pl' | xargs perlcriticdoes not use null delimiters (such as-print0and-0). This allows filenames containing spaces, semicolons, or backticks to execute unintended commands.- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install thePerl::CriticandPerl::Tidymodules using thecpanmpackage manager. This involves fetching and installing configuration and code from the CPAN registry.
Audit Metadata