explore-run
Warn
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/write_outputs.pyutilizesimportlibto dynamically load and execute a Python module from a path computed at runtime (../../../../shared/scripts/write_explore_bundle.py). This allows for the execution of arbitrary code located outside the skill's own directory. - [PROMPT_INJECTION]: The skill processes untrusted JSON data from the
--spec-jsonargument and incorporates it into output files without sanitization, creating a surface for indirect prompt injection. - Ingestion points:
scripts/plan_variants.pyreads user-provided JSON files. - Boundary markers: No boundary markers or isolation instructions are present in the scripts to delimit the untrusted content.
- Capability inventory: The skill possesses code execution capabilities in
scripts/write_outputs.py. - Sanitization: No validation or escaping is applied to fields like
base_commandbefore they are written to outputs.
Audit Metadata