define-variables
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources which may contain malicious instructions.\n
- Ingestion points: Data dictionary files (Excel, CSV, Markdown) and project configuration files (project.yaml).\n
- Boundary markers: No specific delimiters are used to isolate untrusted data from the agent's instructions, nor are there warnings to ignore embedded commands.\n
- Capability inventory: The skill utilizes Read, Write, Edit, and Bash tools to process the data and generate artifacts, providing a high-impact surface for injected instructions.\n
- Sanitization: The skill does not perform any validation or sanitization of the data dictionary content before processing.\n- [DATA_EXFILTRATION]: The skill references and encourages the use of files within ~/.claude/rules/, a hidden configuration directory. Accessing files in the user's home directory is a form of sensitive path access that can lead to unintended exposure of configuration details.\n- [COMMAND_EXECUTION]: The skill utilizes the Bash tool and expects the execution of a script named check_dictionary_citations.py as a mandatory validation step. As the script is not included in the skill package, its execution involves unverified logic that could be manipulated if a malicious version is present in the environment.
Audit Metadata