escrever-trd
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting data from untrusted sources without explicit sanitization or boundary markers.
- Ingestion points: The skill reads project files (Passo 1) such as source code,
package.json, and configuration files. It also fetches data from external web searches and documentation MCPs (Passo 2). - Boundary markers: The instructions do not specify any delimiters or instructions for the agent to ignore potentially malicious embedded content in the files or search results.
- Capability inventory: The skill has the ability to write files to the local system (
docs/trd.md,docs/adrs/) and execute network-enabled tools (WebSearch, MCPs). - Sanitization: There is no evidence of sanitization or validation performed on the ingested content before it is processed into the final documentation templates.
- [COMMAND_EXECUTION]: The skill invokes external tools and Model Context Protocol (MCP) servers (e.g.,
WebSearch,context7) to enrich documentation. This involves executing external capabilities based on parameters inferred from the local project environment. - [DATA_EXFILTRATION]: The skill explicitly scans files frequently associated with sensitive data, such as
.env.example,.env.sample, anddocker-compose.yml, searching for environment variables and API keys (e.g.,STRIPE_SECRET_KEY,REDIS_URL) to identify project dependencies. While this is used for documentation purposes, it involves automated discovery of sensitive configuration patterns.
Audit Metadata