blog-analyze
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a repository-relative script via
python3 scripts/cognitive_load.py <file> --format jsonwhen the--cognitive-loadmode is enabled. Because the<file>argument is supplied by user input or an untrusted external path, this creates a potential command or argument injection vulnerability if the file path is not explicitly validated or sanitized before shell execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to parse and evaluate untrusted blog content from local files or external URLs, opening up an exposure to indirect prompt injection.
- Ingestion points: Handled inside
SKILL.mdunder input handling for local files and URL fetching via WebFetch. - Boundary markers: The skill specifies that fetched content should be treated as untrusted data for extraction only, but lacks explicit markdown or structural delimiters to insulate the core analysis prompt from embedded instructions within the text.
- Capability inventory: The skill possesses command execution capabilities (running the cognitive load python script) and implies an automated optimization action via a suggested
/blog rewritecommand. - Sanitization: Implements strong protocol checking and DNS validation to mitigate server-side request forgery (SSRF), but does not detail content filtering to eliminate instructions or prompt overrides hidden within the extracted blog content.
Audit Metadata