scrivener-inspect
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local Python CLI tool (
cli.py) located in the plugin's root directory to perform read-only operations such as listing the binder outline, searching by query, and reading document content. This is the primary and intended mechanism of the skill. - [PROMPT_INJECTION]: As the skill is designed to ingest and display content from external user files (Scrivener projects), it contains a surface for indirect prompt injection. Malicious instructions could be embedded within document text or synopses.
- Ingestion points: Reads project structure, titles, synopses, and RTF-to-text body content from user-provided
.scrivpaths. - Boundary markers: The toolkit returns structured JSON data by default. There are no explicit instructions to the agent to ignore embedded commands within the content.
- Capability inventory: The skill allows local file reads via a subprocess call to
python3. It does not provide capabilities for file system writes, network exfiltration, or privilege escalation. - Sanitization: The skill instructions do not specify sanitization or escaping of the content read from the Scrivener project before processing.
Audit Metadata