d6e-prompt-driven-ui
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill defines a 'scenario-append' pattern where the agent consumes user-provided template files to dynamically update workspace-level prompt rules. This represents an indirect prompt injection surface. \n
- Ingestion points: SKILL.md ('Scenario-append' section)
- User-provided prompt templates pasted into the chat interface for binding workspace variables.\n
- Boundary markers: Uses specific insertion anchors (e.g., '## 共通ルール') and heading-based idempotency checks to control modification points.\n
- Capability inventory: Utilizes high-privilege MCP tools including
d6e_update_workspace_prompt_rule,d6e_list_saas_credentials, andd6e_call_external_apito modify behavior and fetch sensitive IDs.\n - Sanitization: Instructions include post-condition assertions to ensure placeholders are replaced and explicit guardrails prohibiting destructive operations like rule deletion.\n- [COMMAND_EXECUTION]: The skill uses vendor-specific MCP tools to manage workspace configuration and interact with external SaaS APIs (freee, Google Drive). These operations are restricted to the author's platform environment and are part of the intended administrative functionality.\n- [SAFE]: The core implementation uses robust prompt engineering techniques, such as strict JSON code blocks and Zod-based validation, to ensure reliable communication between the LLM and the frontend with appropriate markdown fallbacks for failed parses.
Audit Metadata