asb-who-me
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates within a narrow scope of conducting an interview and managing a local document. It does not include hardcoded secrets, network exfiltration patterns, or unauthorized system access. The optional use of tools provided by the same author (e.g., asb-rude-qa, asb-voters) is consistent with its primary purpose of self-discovery.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user input, which creates an inherent surface for indirect prompt injection, although the risk is minimized by the skill's limited capabilities and local output. 1. Ingestion points: The skill collects user responses to a variety of evocative prompts and homework answers (SKILL.md). 2. Boundary markers: The output is structured with markdown headers and numbered identifiers (M1, M2), but it does not employ specific security delimiters to segregate untrusted user data from agent instructions. 3. Capability inventory: The skill has the capability to create and modify a specific file (WHO-ME.md) on the local file system. 4. Sanitization: No explicit content filtering or sanitization of user-provided input is specified before it is stored in the self-discovery file.
Audit Metadata