tweet-draft-reviewer
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script to scan for tweet drafts. The script incorporates the
VAULT_PATHenvironment variable or user-provided path directly into a shell command (find). If the path string contains shell metacharacters like backticks or command substitution sequences, it could lead to arbitrary command execution when the agent runs the script.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process the content of external markdown files from a user's drafts folder. This represents a significant attack surface for indirect prompt injection, where a malicious file could contain instructions that override the agent's behavior during the review process.\n - Ingestion points: PHASE 1 (SKILL.md) and Intake (SKILL-OC.md) use shell tools to identify and read the content of
.mdfiles.\n - Boundary markers: Absent. The skill does not use delimiters or instructions to ignore potential commands within the analyzed drafts.\n
- Capability inventory: The skill explicitly requires and uses the
bashtool for file system operations and content searching (grep).\n - Sanitization: Absent. There is no evidence of input validation or escaping for the content being read from the draft files.
Audit Metadata