upwork-client-messenger
Warn
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is instructed to access potentially sensitive local file paths.
- Evidence: The skill documentation indicates it should read identity and rate context from
upwork-profile.mdor files within the~/.claude/directory. - Context: This access is used to personalize the drafted messages. However,
~/.claude/is a hidden configuration directory for the agent platform, and accessing it for skill-specific data is a behavior that requires review to ensure it does not expose other sensitive agent configurations. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its primary data ingestion mechanism.
- Ingestion points: The skill accepts "thread context" (pasted client messages) as a primary input in the SKILL.md instructions.
- Boundary markers: The instructions do not define clear boundary markers or delimiters to encapsulate the untrusted client text.
- Capability inventory: The skill has the capability to read local files (
upwork-profile.md) and generate text based on user/client input. - Sanitization: There is no instruction to sanitize or ignore commands embedded within the pasted client thread context.
Audit Metadata