message-test-designer
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted user data, creating a surface for indirect prompt injection. 1. Ingestion points: Message variants and panel notes are processed in the instructions (Step 1 and 5). 2. Boundary markers: The skill does not use delimiters to isolate untrusted content from its instructions. 3. Capability inventory: The skill has the ability to write to files in the memory/ directory and execute local Python scripts. 4. Sanitization: No technical sanitization or validation is applied to external content beyond a natural language warning to the agent.
- [COMMAND_EXECUTION]: The skill instructs the agent to run a local script,
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/experiment.py", using arguments derived from test results. While this is a local utility, if the input variables are not strictly validated as numeric, it could present a vector for command injection.
Audit Metadata