review-markdown-comments
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read, parse, and modify untrusted data within Markdown files (CriticMarkup fragments and JSON metadata), creating a surface for indirect prompt injection.
- Ingestion points: The agent reads the complete body of user-provided Markdown files to locate comment anchors (
{#cN}), comment bodies ({>>...<<}), and HTML-wrapped JSON metadata. - Boundary markers: The skill uses specific delimiters like CriticMarkup tags and HTML comments (
<!-- hubble-review:... -->) to identify data, but it lacks explicit instructions to the agent to ignore or sanitize instructions that might be embedded within the comment text itself. - Capability inventory: The agent is authorized to read files, write files, and execute
git diffcommands. - Sanitization: The skill provides logic for JSON validation and serialization, including specific escaping for HTML comment terminators (
\u002d\u002d), but does not provide mechanisms to prevent the agent from following natural language instructions found within the processed comments.
Audit Metadata