craftbot-skill-improve
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes 'Action traces' from completed tasks to determine how to apply surgical edits to skill files. This creates a vulnerability where adversarial content within the traces could influence the agent to inject malicious instructions into the permanent skill library.
- Ingestion points: The skill uses
read_fileto ingest absolute paths toSKILL_SOURCE_<id>.mdfiles, which contain records of past agent reasoning and tool outputs. - Boundary markers: There are no boundary markers or instructions to treat the action trace content as untrusted data or to ignore potential instructions embedded within the logs.
- Capability inventory: The skill uses
stream_editto modifySKILL.mdfiles, providing a mechanism for persistent modification of agent instructions based on untrusted log data. - Sanitization: The skill does not include any validation or sanitization of the evidence gathered from the action trace before it is used to formulate edits.
Audit Metadata