trailmark-structural
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
{args}parameter, which is user-controlled, is interpolated directly into Bash command templates in Step 2 (find {args} -type f ...) and Step 3 (trailmark analyze ... {args}) without shell-safe quoting or validation. This vulnerability allows an attacker to execute arbitrary system commands by providing a directory path string containing shell delimiters such as semicolons, pipes, or command substitution syntax.
Audit Metadata