writing-fragments
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted data from both user conversations and local files.
- Ingestion points: The agent is instructed to capture fragments from the 'very first thing the user says' and to 're-read the file from disk' (SKILL.md) before every write operation.
- Boundary markers: The instructions lack explicit delimiters or safety markers to differentiate between data to be saved and potential instructions embedded within the user input or the file content.
- Capability inventory: The agent is granted capabilities to read from and append to the local file system based on user-provided paths (SKILL.md).
- Sanitization: There are no mechanisms described for validating, escaping, or filtering the content harvested from the user or the file system before it is processed by the agent's logic.
Audit Metadata