dossier
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill configures repository-level hooks located in
.claude-plugin/hooks/(specificallydossier-hook-dispatcher.shandballot-filename.sh) that execute shell commands on the host machine. These scripts are triggered by the agent platform during tool operations (PostToolUse) to validate dossier file naming and structure. While these are legitimate developer tools from the skill author, they represent a capability for local command execution. - [PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from the internet via search and fetch tools, creating an attack surface for indirect prompt injection (Category 8).
- Ingestion points: The agent collects data from arbitrary third-party websites during the GATHER phase using
WebSearchandWebFetchas described inSKILL.md. - Boundary markers: Absent. There are no explicit instructions or unique delimiters provided to the agent to treat fetched web content as untrusted data or to ignore instructions embedded within that content.
- Capability inventory: The skill possesses capabilities for web searching, web fetching, file writing, and local shell execution via the repository hooks.
- Sanitization: Absent. The workflow does not include specific validation or sanitization steps for external data before it is synthesized into a dossier.
Audit Metadata