flow-journal
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and follow decisions and permissions stored in local markdown files, which could lead to the execution of malicious instructions if those files are modified by external sources.
- Ingestion points: The agent is directed to read journal.md and reprise.md from the .task directory to initialize new sessions as described in SKILL.md.
- Boundary markers: No specific delimiters or safety warnings are provided to prevent the agent from obeying instructions embedded within the journal text.
- Capability inventory: The skill involves writing to the local filesystem and restores the agent's authorized scope based on document content.
- Sanitization: The skill does not mention any validation or sanitization of the content read from the journal files before treating it as authoritative.
Audit Metadata