Letter Writer

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Node.js fs module to write generated Word documents and batch summary reports to the local file system using fs.writeFileSync.
  • [DATA_EXFILTRATION]: Includes code for an optional integration using the nodemailer package to send generated letters as email attachments.
  • [PROMPT_INJECTION]: The batch generation workflow contains a surface for indirect prompt injection through data ingestion.
  • Ingestion points: Data is ingested via templatePath and recipientsData (CSV/JSON).
  • Boundary markers: No boundary markers or delimiters are present to isolate external content.
  • Capability inventory: File system writes (fs) and network transmission (nodemailer).
  • Sanitization: The skill does not perform validation or sanitization on the external data before it is processed by the Handlebars templating engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 02:42 AM
Security Audit — agent-trust-hub — Letter Writer