ask-claude
Fail
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses string interpolation to place user-provided arguments directly into shell commands such as
omx ask claude "{{ARGUMENTS}}"andclaude -p "{{ARGUMENTS}}". This pattern is vulnerable to command injection because shell metacharacters (e.g.,;,&&,|, or backticks) provided in the input can be used to execute unauthorized system commands on the host machine. - [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing untrusted user data. Ingestion points: User input enters via the
{{ARGUMENTS}}placeholder in SKILL.md. Boundary markers: Arguments are wrapped in double quotes, which do not provide adequate protection against shell escaping or command termination. Capability inventory: The skill can execute local subprocesses and write to the filesystem (.omx/artifacts/). Sanitization: There is no evidence of input validation, filtering, or character escaping to prevent malicious data from manipulating the shell execution.
Recommendations
- AI detected serious security threats
Audit Metadata