editorial-proof
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted text from user-provided documents, style sheets, and local context files across several stages. Attacker-controlled data within these sources could potentially contain instructions aimed at influencing the agent's behavior during the analysis passes.
- Ingestion points: Processes document content (PDF, web pages, Word), Style Sheets, and the
.agents/editorial-context.mdfile. - Boundary markers: The instructions do not define delimiters or specific warnings to distinguish between the content being proofed and the agent's operating instructions.
- Capability inventory: The agent maintains state via file-write operations to
.agents/editorial-context.mdand performs network requests to verify hyperlinks. - Sanitization: No sanitization or escaping of the processed text is implemented.
- [DATA_EXFILTRATION]: During the 'Final Hygiene Check' (Pass 4), the agent is instructed to 'Click every link' to verify they resolve and go to the correct destination. This requires the agent to make network requests to arbitrary external domains found within the untrusted document content, which could be exploited for tracking or data signaling.
Audit Metadata