open-sets
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute a local script located atscripts/z3_solve.pyusinguv run. This is used to perform mathematical verification tasks using the Z3 theorem prover harness. - [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it processes untrusted user-supplied mathematical expressions.
- Ingestion points: Mathematical formulas and proof targets (e.g., in the
Z3_Epsilon_Deltatool command) enter the context through user queries. - Boundary markers: There are no defined delimiters or instructions to the agent to ignore embedded commands within the mathematical strings.
- Capability inventory: The skill has access to the
Bashtool to execute scripts. - Sanitization: There is no evidence of sanitization or escaping of the proof strings before they are passed as arguments to the shell command, which could be exploited for command injection if the agent interpolates user input directly.
Audit Metadata