polish-batch
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill captures user-defined UI cosmetic fixes and passes these strings verbatim to a coding CLI and sub-agents for project modification, creating a surface where malicious instructions could be embedded in the captured data.
- Ingestion points: User input is collected in SKILL.md during the 'capture' phase and written to punch-list markdown files in the specs/qa/ directory.
- Boundary markers: The skill provides instructions to separate cosmetic nits from behavioral changes, but does not provide delimiters or instructions to ignore potential commands within the user-supplied strings.
- Capability inventory: The skill uses browser tools for evidence collection and screenshots, writes to the file system, and triggers code modifications through a coding CLI and local sub-agents.
- Sanitization: The skill lacks sanitization, explicitly instructing the agent to pass user-provided strings verbatim to the dispatch phase.
Audit Metadata