file-comment
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from file comments, which could potentially contain instructions intended to influence the agent's behavior during file review or revision tasks.\n
- Ingestion points: Data is ingested through the
GET /v1/files/{fileId}/commentsendpoint defined inSKILL.md.\n - Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore potentially malicious content within the comments.\n
- Capability inventory: The skill allows network-based write operations (creating, editing, and deleting comments) but does not provide access to the local file system or arbitrary command execution.\n
- Sanitization: No content sanitization or validation mechanisms are described for the comment text.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests to
data.spuree.comto manage file comments. This domain is a product-specific resource associated with the vendor's service.
Audit Metadata