long-chat-task-processor
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large, unstructured chat logs (Markdown format) provided by users. This creates a surface for indirect prompt injection attacks where malicious instructions hidden within the chat logs could influence the agent's behavior during the extraction and synthesis phases.
- Ingestion points: The agent reads content from
1-原始记录/(source chat logs) and2-项目背景/(user-provided background documents). - Boundary markers: There are no explicit boundary markers or instructions telling the agent to treat the ingested chat content strictly as data and to ignore any embedded directives.
- Capability inventory: The agent has capabilities to read and write multiple files in the workspace, including project logs, task pools, and decision documents. It also executes a local setup script.
- Sanitization: The instructions do not specify any sanitization, filtering, or validation of the content extracted from the chat logs before it is written to other workspace documents.
- [COMMAND_EXECUTION]: The skill requires the execution of a local Python script (
scripts/setup_workspace.py) to initialize the project directory and parse the Markdown structure. - Evidence:
python3 .gemini/skills/long-chat-task-processor/scripts/setup_workspace.py "path/to/chat_log.md" "工作区目录名称"inSKILL.md.
Audit Metadata