writeup
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a structured workflow for drafting content based on user sessions. It limits its operations to reading specified configuration files (style guides) and writing to designated draft folders.\n- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface by ingesting untrusted data from the current and recent session logs to generate its drafts. This is a common surface for indirect prompt injection, though the impact is limited by the skill's lack of high-privilege capabilities.\n
- Ingestion points: The skill scans the 'current session' and 'recent sessions' to extract insights, learnings, and artifacts (SKILL.md, Step 1).\n
- Boundary markers: No explicit delimiters or instructions to the agent to disregard potential commands within the session data were found.\n
- Capability inventory: The skill is capable of writing content to the local file system in a user-defined drafts folder (SKILL.md, Step 5).\n
- Sanitization: No specific filtering or sanitization of input data from the session logs is described.
Audit Metadata