recap
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests the entire conversation history, which may contain malicious instructions or content from external sources.
- Ingestion points: The skill reads all user messages in the chat session chronologically as specified in the
Workflowsection ofSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands within the summarized data.
- Capability inventory: The skill possesses file-write capabilities, allowing it to save HTML files to the local workspace (e.g., in
docs/session-recaps/or the root directory). - Sanitization: The instructions lack requirements for HTML escaping or sanitization of content extracted from the conversation. If malicious HTML or JavaScript was provided in a previous chat turn, it could be persisted into the output file, leading to a Stored Cross-Site Scripting (XSS) vulnerability when the recap is opened in a browser.
Audit Metadata