blog-write
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources including web search results, user-provided briefs, and project-level configuration files (BRAND.md, VOICE.md, DISCOURSE.md). \n
- Ingestion points: Ingestion occurs during Phase 1 (user topics/briefs), Phase 2 (search results and notebook answers), and through the reading of project-root files. \n
- Boundary markers: The instructions mandate the use of a "fenced helper" (load_untrusted_root.py) and a specific "Untrusted-Data Contract" to separate data from instructions. \n
- Capability inventory: The skill can execute shell commands for preflight checks and rendering, perform web searches, and invoke other sub-skills like blog-researcher or blog-image. \n
- Sanitization: The skill explicitly instructs the agent to ignore instruction-shaped text within data files and to reject unsafe URL schemes like javascript:, data:, and file:. \n- [COMMAND_EXECUTION]: The skill executes local Python scripts using python3 to handle article rendering, preflight checks, and hero image generation. \n
- Evidence: Instructions in Phases 5 and 6.5 detail the execution of scripts (blog_preflight.py, generate_hero.py, blog_render.py) located in a resolved BLOG_SCRIPT_DIR. \n
- Mitigation: To prevent command injection from user-supplied titles or tags, the instructions require the agent to wrap shell arguments in single quotes and properly escape embedded single quotes.
Audit Metadata