we-media-practice
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-managed files (e.g., STATE.md, experiments/.md, reviews/.md) to restore context and make decisions. There is a lack of explicit boundary markers or sanitization logic to differentiate between recorded data and potential instructions embedded within those records. This creates a surface where malicious content in a project record could influence the agent's behavior in future sessions.\n
- Ingestion points: The agent reads files from a user-specified directory, specifically STATE.md and Markdown files in the experiments/ and reviews/ subdirectories as defined in SKILL.md and references/record-templates.md.\n
- Boundary markers: Absent. Instructions in SKILL.md direct the agent to "read the latest experiment" and "restore context" without providing delimiters or warnings to ignore instructions embedded in those data files.\n
- Capability inventory: The skill has the ability to write project records to the local filesystem and invoke external skills such as idea-meat-grinder and we-media-content-studio as described in SKILL.md.\n
- Sanitization: Absent. While SKILL.md encourages the agent to verify facts and distinguish between hypotheses and confirmed information, there is no technical validation or filtering applied to the content read from the record files.
Audit Metadata