Writing
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection via the documents it ingests and processes.
- Ingestion points: The skill reads user-provided files (
content-file,vision,sources) in Phase 1 and interpolates their contents into subagent prompts during Phase 2. - Boundary markers: The prompt template in
prompts/judge.mdplaces the interpolated section text under a header but lacks explicit instructions for the AI to ignore embedded or adversarial instructions within that text. - Capability inventory: The agent has access to the
Edittool to modify the local filesystem. While Phase 4 requires user approval for each change, an injection attack could trick the subagents into generating malicious or destructive 'Proposals' that a user might approve. - Sanitization: No sanitization, escaping, or structural validation is performed on the ingested content before it is processed by the LLM judges.
Audit Metadata