cs-note
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core function is to append user-provided project rules to
.codestable/attention.md. This file is explicitly defined as 'mandatory context' (强制必读) for the AI at the start of every session. This creates a mechanism for persistent prompt injection where malicious instructions could be stored in the project's metadata and influence future AI behavior across all CodeStable skills. - Ingestion points: Processes untrusted user input provided during '记一笔' (note-taking) or '加到 attention.md' triggers.
- Boundary markers: The skill uses a comment
<!-- cs-note managed -->to identify its section, but it does not specify any sanitization, escaping, or 'ignore instructions' wrappers for the content being appended. - Capability inventory: Performs file-system read and write operations on
.codestable/attention.md. It also performs keyword-based 'grep' (search) for deduplication. - Sanitization: No sanitization or validation of the user-provided text is performed before it is written to the persistent project file.
- [COMMAND_EXECUTION]: The skill involves reading and writing to the local file system (specifically the
.codestable/directory). While the intended use is for configuration/documentation, an agent implementing these instructions has the capability to modify the project structure and create files that alter the agent's own behavioral context.
Audit Metadata