Letter Writer
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Node.js
fsmodule to write generated Word documents and batch summary reports to the local file system usingfs.writeFileSync. - [DATA_EXFILTRATION]: Includes code for an optional integration using the
nodemailerpackage to send generated letters as email attachments. - [PROMPT_INJECTION]: The batch generation workflow contains a surface for indirect prompt injection through data ingestion.
- Ingestion points: Data is ingested via
templatePathandrecipientsData(CSV/JSON). - Boundary markers: No boundary markers or delimiters are present to isolate external content.
- Capability inventory: File system writes (
fs) and network transmission (nodemailer). - Sanitization: The skill does not perform validation or sanitization on the external data before it is processed by the Handlebars templating engine.
Audit Metadata