aws-wechat-article-main
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (validate_env.py) to verify the execution environment and configuration integrity. It also provides shell commands for directory setup and file management during the initialization phase.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it coordinates the ingestion of untrusted data from external sources (e.g., web search results gathered by the topics sub-skill) to generate final article content. 1. Ingestion points: External data enters the context through research.md and topic-card.md files located in the article draft directory. 2. Boundary markers: The skill relies on natural language boundaries within the prompts of the writing and review sub-skills to separate instructions from untrusted data. 3. Capability inventory: The system is capable of writing to the local filesystem (HTML/YAML files), executing shell commands for environment validation, and performing network requests to WeChat and LLM APIs via sub-skills. 4. Sanitization: No specific programmatic sanitization was found in the main orchestrator; it primarily depends on the underlying LLM's safety filters and the review sub-skill's oversight.
Audit Metadata