make-tweakable
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by creating a feedback loop between user-controlled browser state and agent actions.\n
- Ingestion Point: The
pending.yamlfile (referenced in Phase 4 and Step 6) is intended to be read by the agent after being written by a client-side script.\n - Boundary Markers: The skill does not define specific delimiters or instructions for the agent to ignore embedded commands within the YAML values.\n
- Capability Inventory: The agent is instructed to use the
Edittool to modify local HTML files based on the contents of the YAML file.\n - Sanitization: No sanitization or schema validation is defined for the values received from the client-side script before they are processed by the agent.\n- [COMMAND_EXECUTION]: The skill executes shell commands to set up its working environment.\n
- Evidence: Uses the
Bashtool withmkdir -pin Phase 4 to prepare directory structures for session state and artifact storage.
Audit Metadata