ds-ledger
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a feedback loop where the agent reads its own previous logs to determine future steps. This pattern introduces a vulnerability surface if the log file content is manipulated or contains instructions. The following evidence chain was identified: 1. Ingestion points: The agent reads the .ds-ledger.tsv file in SKILL.md to verify that the next step serves the goal. 2. Boundary markers: No delimiters or instructions to ignore potential commands within the ledger content are provided. 3. Capability inventory: The agent performs filesystem operations and tracks command execution as part of its primary function. 4. Sanitization: The skill does not specify any sanitization or validation of the data read from the ledger file.
Audit Metadata