skills/jeremylongshore/claude-code-plugins-plus-skills/generating-compliance-reports/Gen Agent Trust Hub
generating-compliance-reports
Warn
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The utility
scripts/generate_report.pyincludes agenerate_scriptfunction that creates shell scripts and explicitly modifies file permissions to make them executable usingchmod 0o755. - [REMOTE_CODE_EXECUTION]: The
generate_scriptmethod inscripts/generate_report.pyassembles a bash script from content passed via command-line arguments, which allows for the dynamic generation and execution of code. - [PROMPT_INJECTION]: The skill analyzes untrusted data from target codebases and configurations, representing an indirect prompt injection risk. Evidence: 1. Ingestion points: Files scanned within the
${CLAUDE_SKILL_DIR}/directory. 2. Boundary markers: The instructions do not define delimiters or provide warnings for the agent to ignore instructions embedded in the analyzed data. 3. Capability inventory: The skill allows the use of theBashtool and includes a custom script generation utility. 4. Sanitization: There is no evidence of validation or sanitization of content read from external files before processing.
Audit Metadata