dineway-social-plan
Warn
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE_&_EXFILTRATION]: The skill is instructed to access and read environment files (
.env) to locate explicit database URLs. Environment files often contain sensitive secrets, and unauthorized access poses a risk of credential exposure. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill searches for and reads local SQLite database files (e.g.,
data.db,database.sqlite). These files may contain proprietary business data or sensitive customer information. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill performs network requests (fetching pages like
/menuand/reviews) to a domain dynamically constructed from thetargets.forgeway.siteDomainfield in.dineway/deploy.json. This pattern introduces a Server-Side Request Forgery (SSRF) risk if an attacker can influence the contents of the configuration file. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from both external websites and local databases to generate social media content.
- Ingestion points: Remote URLs fetched via
fetch, local SQLite databases, and project configuration files (deploy.json,.env). - Boundary markers: The skill contains a "Boundaries" section to restrict behavior, but does not implement technical delimiters (like XML tags or specific markers) when interpolating external data into the prompt.
- Capability inventory: File system read (SQLite/Env), Network read (fetching site data), and File system write (writing to
./output/social-plans/). - Sanitization: There is no evidence of sanitization or validation performed on the data retrieved from external sources before it is used to generate the social media plan.
Audit Metadata