ps-show-me-your-work
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to audit the decision log against the run's transcript history. This creates a potential surface where malicious instructions previously ingested from external sources and recorded in the transcript could be re-processed by the agent during the audit phase.
- Ingestion points: The
agent-transcripts/directory, which is read at the end of the run. - Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore embedded commands when reading the transcript.
- Capability inventory: The skill possesses file writing capabilities via
scripts/log.sh. - Sanitization: The
scripts/log.shscript implements sanitization by stripping newline/tab characters and escaping common spreadsheet formula triggers (=,+,-,@) with a single quote. - [COMMAND_EXECUTION]: The skill uses a local bash script (
scripts/log.sh) to manage the decision log. This script executes standard shell commands includingprintf,tr,mkdir, and redirection for file appending. - [DATA_EXFILTRATION]: The skill accesses the
agent-transcripts/directory. Although restricted by the instructions to only the current workspace's transcripts to avoid reading unrelated private chats, this represents access to sensitive session data to perform its audit function.
Audit Metadata