youarehere-full
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read the content of files the user is currently editing in VS Code to provide context for answers. This creates a surface for indirect prompt injection where malicious instructions embedded in a code file could influence the agent's behavior.
- Ingestion points: The skill reads metadata from
~/.youarehere/context.jsonand then ingests the full content of the file path specified in that JSON (the user's active editor file). - Boundary markers: The instructions do not specify any delimiters or special handling to differentiate between the agent's instructions and the content of the file being read.
- Capability inventory: The agent uses file system read capabilities to access the source code files.
- Sanitization: There is no evidence of sanitization, filtering, or escaping of the content read from the external file before it is processed by the LLM.
Audit Metadata