process-directory-list
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a JSON file and interpolates it directly into prompts for sub-agents, creating a surface for indirect prompt injection attacks. \n- Ingestion points: The skill reads directory paths and item IDs from
directory-instructions.jsonin the project root. \n- Boundary markers: Absent; instructions for sub-agents do not use delimiters (e.g., XML tags or triple backticks) to wrap the external data or include warnings to ignore instructions embedded within the directory names. \n- Capability inventory: The skill uses the Task tool to spawn sub-agents, invokes the/generate-instructionsskill, and performs file system read/write operations on the configuration file. \n- Sanitization: Absent; there is no evidence of input validation, escaping, or filtering for the data read from the JSON file before it is used to construct prompts.
Audit Metadata