path-reference-auditor
Warn
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/build_explicit_inventory.pydynamically generates a bash script intended for fixing broken symlinks. - Evidence: The script writes command strings to
/tmp/apply_symlink_repairs.shby interpolating file paths and names discovered viaos.walkdirectly intoln -f -scommands. - Vulnerability: There is no sanitization or escaping of the filesystem metadata (names and paths) before they are written into the shell script. If a directory contains a file named with shell metacharacters (e.g.,
; rm -rf / ;), the resulting script would execute those unintended commands when run by the user. - Risk: This represents a classic command injection surface where external data (filenames) influences executable logic (the generated repair script).
Audit Metadata