editorial-reconciliation
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to read external content from
../../references/FEATURE_EDITORIAL_RECONCILIATION.mdand the current 'durable project state'. These inputs represent potential ingestion points for untrusted or attacker-controlled data. - Ingestion points:
../../references/FEATURE_EDITORIAL_RECONCILIATION.md, project state files. - Boundary markers: Absent; the instructions do not specify delimiters or warnings to ignore embedded instructions in these files.
- Capability inventory: The skill executes a Python script (
../../scripts/editorial_reconcile.py) to perform state changes. - Sanitization: Not present; there is no mention of validating or filtering the content retrieved from the reference or project files before use.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to run a local Python script (
../../scripts/editorial_reconcile.py) to perform deterministic state changes and checks. While this is part of the intended workflow, it provides the execution capability that could be targeted by indirect injections.
Audit Metadata