gzh-design
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data, including Word (.docx), PDF, and plain text articles, to perform layout normalization and conversion. This ingestion of external data creates an attack surface for indirect prompt injection.
- Ingestion points: Step 0 (Input and format normalization) where Word, PDF, and text files are read.
- Boundary markers: None identified in the normalization workflow to distinguish between article content and potentially malicious instructions.
- Capability inventory: Subprocess execution of local scripts (
validate_gzh_html.py,wrap_preview.py) and file system write access. - Sanitization: The included
validate_gzh_html.pyscript validates HTML structure for WeChat platform compliance but does not filter or sanitize natural language instructions embedded within the processed content. - [COMMAND_EXECUTION]: The skill instructions direct the agent to execute local Python scripts using shell commands to validate and wrap the generated HTML.
- Evidence:
SKILL.mdStep 5 and 6 invokescripts/validate_gzh_html.pyandscripts/wrap_preview.pyvia the command line. While these are internal functional tools, they utilize system-level execution capabilities.
Audit Metadata