content-write
Fail
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses a Python heredoc (`python3
- <<'PY'
) to log metadata, directly interpolating variables like{keyword},{site}, and{title}` from the content brief into the Python source code. A malicious brief could include Python string-breaking characters and code (e.g., via double quotes) to execute arbitrary Python commands on the system.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by ingesting untrusted data without proper isolation.\n - Ingestion points: The skill reads JSON files from
~/.kai-marketing/briefs/to populate the writing context.\n - Boundary markers: No markers or explicit instructions are provided to the model to ignore embedded commands within the brief data.\n
- Capability inventory: The skill has the ability to write files, execute shell commands via
kai-gate, and run dynamic Python code.\n - Sanitization: No sanitization, escaping, or validation is performed on the brief fields before they are used in the prompt or code execution.\n- [COMMAND_EXECUTION]: The skill executes local shell commands such as
kai-gate scoreandsourceusing arguments derived from file paths and brief metadata. The lack of input validation for these arguments presents a risk of shell command injection.\n- [DATA_EXPOSURE]: The skill accesses sensitive local directories (~/.kai-marketing/) containing user-specific voice profiles, marketing defaults, and previous content briefs, which could be exposed if the agent is manipulated via injection.
Recommendations
- AI detected serious security threats
Audit Metadata