teach
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided files (untrusted data) to extract patterns and save them to a shared project scope, which represents an attack surface for indirect prompt injection.
- Ingestion points: The workflow reads arbitrary files referenced by the user (e.g., via
@filereferences) as seen in Step 1 of theSKILL.mdworkflow. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between the file's data and potential instructions embedded within the file.
- Capability inventory: The skill uses the
training_savetool to persist extracted data to the project environment, which could result in malicious 'patterns' being shared with the rest of the team or reused in future sessions. - Sanitization: The instructions do not include steps to sanitize, escape, or validate the content extracted from the example files before saving them via the
training_savetool.
Audit Metadata