writing-fragments
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to re-read the target markdown file from disk before every write operation. This ensures user edits are preserved but creates a vector where content within the file can influence the agent's behavior.
- Ingestion points: The agent reads content from a user-specified markdown file (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the agent when it processes the file content or user-supplied fragments.
- Capability inventory: The skill possesses the capability to read from and append to the local file system (SKILL.md).
- Sanitization: The skill lacks logic to sanitize, escape, or validate the content read from the file before processing it.
- [COMMAND_EXECUTION]: The instructions mandate that the agent performs file append operations silently ('Don't ask permission for each fragment') once a path is set. This design choice reduces user oversight regarding which data is being written to the file system.
Audit Metadata