capture-feedback
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill captures verbatim user corrections and stores them in local JSON files. When the 'list' or 'show' commands are used, this untrusted content is displayed back to the agent, creating an indirect prompt injection surface where malicious feedback could influence the agent's behavior during retrieval.
- Ingestion points: SKILL.md (Capture Flow) and capture_feedback.py (cmd_capture).
- Boundary markers: None present to delimit or warn the agent about instructions within the retrieved notes.
- Capability inventory: Execution of local Python script and restricted file system access within ~/.agents.
- Sanitization: No sanitization is performed on the user_words content.
- [COMMAND_EXECUTION]: The skill instructions provide a shell command pattern for executing the bundled script with user-provided text as arguments. While the script handles arguments securely using argparse, if the execution tool does not properly handle escaping for the verbatim string, it could lead to command injection.
Audit Metadata