rail-slice
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from local specification files, creating a surface for potential instruction injection if those files contain malicious content.\n
- Ingestion points: The skill reads
spec.mdfiles from thedocs/monorail/directory to derive context for task creation.\n - Boundary markers: No explicit delimiters are defined to isolate the ingested text or instruct the model to ignore embedded commands.\n
- Capability inventory: The skill can execute shell commands (
ls) and write multiple new Markdown files to the local filesystem.\n - Sanitization: No validation or filtering of the specification content is performed before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill utilizes local shell commands for environment verification.\n
- Evidence: The instructions explicitly direct the agent to use
lsto confirm the presence of files within thedocs/monorail/hierarchy.
Audit Metadata