dsh-trim-cot-leakage
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes repository prose (READMEs, JSDoc, Agent Notes) as untrusted input, creating an attack surface where malicious instructions could be embedded in the audited text.
- Ingestion points: Prose files throughout the repository (excluding
vendor/and archived notes). - Boundary markers: Absent; the skill does not specify delimiters or instructions to ignore embedded commands in the source text.
- Capability inventory: Includes reading files, executing
rg(ripgrep) search commands, and writing modifications to files. - Sanitization: Absent; the skill relies on the agent's semantic judgment without pre-processing or escaping inputs.
- [COMMAND_EXECUTION]: The skill requires the execution of shell commands and project-specific scripts to identify and verify changes.
- Evidence:
references/recall-batteries.mdcontains multiplerg(ripgrep) command templates.SKILL.mdreferences running project "gates" such asdoc-sync,verify-type-equiv, andverify-translation-pairing.
Audit Metadata