hex1b
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution Capability: The
hex1btool is designed to launch and control arbitrary processes within a virtual terminal (e.g.,dotnet hex1b terminal start -- <command>). This capability is a fundamental part of the skill's automation purpose, allowing for interaction with shells, TUI apps, and other CLI tools. - External Tool Installation: The skill instructs users to install the
Hex1b.Toolusing the standard.NETglobal tool installation command. This fetches the utility from the official NuGet registry, which is a trusted package management service. - Terminal Capture and Observation: The tool provides functionality to capture terminal content through screenshots (PNG, SVG, Text) and recordings. These features enable the agent to monitor the state of the automated process and verify that actions are proceeding as expected.
- Indirect Prompt Injection Surface: Because the skill reads and processes output from external terminal applications, it possesses an attack surface for indirect prompt injection. If an automated program displays malicious text designed to influence the agent, it could potentially affect downstream decisions. This is an inherent consideration for any skill that interacts with external data sources.
Audit Metadata