writing-fragments
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions mandate that the agent re-read the markdown file from disk before every write to account for external user edits. This behavior ingests untrusted data into the agent's execution context. Because there are no boundary markers or explicit instructions to ignore commands within the file, an attacker could inject malicious instructions into the markdown document that the agent might subsequently execute.\n
- Ingestion points: Reading user-specified markdown files from the local file system.\n
- Boundary markers: None; the content is treated as heterogeneous fragments.\n
- Capability inventory: File system read and write operations.\n
- Sanitization: None; the agent is instructed to preserve changes and heterogeneous content.\n- [COMMAND_EXECUTION]: The skill requires the agent to interact with the local file system to read from and append to files. While this is the intended functionality for a writing assistant, it involves executing system-level operations based on user-provided file paths.
Audit Metadata