Water Tracker
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (beverage descriptions) and stores it in
log.md. This data is later read by the agent to generate intake trends and summaries. The lack of sanitization or boundary markers creates a surface where malicious instructions embedded in a drink mention could be interpreted as agent commands during subsequent log processing. - Ingestion points: Beverage descriptions and container names provided by the user in chat, as described in
logging.mdandSKILL.md. - Boundary markers: None; entries are appended to
log.mdas plain markdown lines without delimiters to isolate user-provided text from agent instructions. - Capability inventory: The skill has capabilities to read and write local files (
log.md,memory.md,config.yaml) within the~/Clawic/data/water/directory. - Sanitization: No sanitization, escaping, or schema validation is performed on the beverage source or container name strings before they are persisted and re-read.
Audit Metadata