react-coder
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection] (HIGH): The skill is highly vulnerable because it processes external data and has powerful execution capabilities.
- Ingestion points: Instructions from the user and content retrieved via WebSearch.
- Boundary markers: Absent; there are no instructions to prevent the agent from obeying commands embedded in external content.
- Capability inventory: Includes 'Bash' for shell access, 'Write' and 'Edit' for file system modifications, and 'WebSearch' for network data.
- Sanitization: None. An attacker could place malicious instructions on a website that the agent visits, leading to unauthorized command execution.
- [Command Execution] (HIGH): The skill has 'Bash' in its allowed-tools, which allows for arbitrary command execution on the host system.
Recommendations
- AI detected serious security threats
Audit Metadata