agent-native-architecture
Warn
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill encourages providing agents with a
bashtool for 'maximum flexibility.' This allows the agent to execute arbitrary system commands, which is a critical security risk if the environment is not strictly sandboxed. - [REMOTE_CODE_EXECUTION]: The 'Self-modification' pattern described in the documentation instructs agents on how to read, modify, and overwrite their own source code. It further suggests tools for agents to
git push,restart, andself_deploy, enabling persistent and autonomous code execution that could be exploited if the agent is compromised. - [PROMPT_INJECTION]: The architectural patterns involving 'Dynamic Context Injection' and 'Web Search' rely on the ingestion of untrusted external data. The skill does not mandate strict sanitization or the use of rigid instruction boundaries, instead relying on the agent's 'judgment,' which creates a vulnerability surface for indirect prompt injection attacks.
- [COMMAND_EXECUTION]: The MCP tool design patterns include a generic
call_apitool that allows agents to make arbitrary HTTP requests with user-defined methods and bodies. This provides a mechanism for unauthorized data exfiltration or interaction with internal network services.
Audit Metadata