folder-management
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it retrieves potentially untrusted data and maintains significant capabilities.
- Ingestion points: Data enters the agent's context through folder names, descriptions, and tags retrieved from retrieval endpoints such as
GET /v1/search/folders,GET /v1/folders, andGET /v1/sessions/{sessionId}/childrenas specified inSKILL.md. - Boundary markers: The skill does not provide instructions to the agent to treat metadata as data rather than instructions, nor does it define delimiters for these fields.
- Capability inventory: The skill grants the agent the ability to delete folders (
DELETE /v1/sessions/{sessionId}), modify structures (PATCH /v1/sessions/{sessionId}), and generate presigned S3 URLs for file downloads (POST /v1/sessions/files/download/urls), all of which could be subverted if malicious content in folder names is interpreted as a command. - Sanitization: No sanitization or escaping mechanisms are described for handling the natural language metadata received from the API responses.
Audit Metadata