qstack-update-plan-assets
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read and follow instructions from a sibling file path (
qstack-plan-to-html/references/update-plan-assets.md). This creates an architectural surface for indirect prompt injection.\n- Ingestion points: The agent is instructed to resolve and read a sibling markdown file.\n- Boundary markers: There are no explicit boundary markers or instructions to ignore embedded prompts; the agent is simply told to "follow it" completely.\n- Capability inventory: The skill mentions a "deterministic update script" and template refreshing, indicating the agent may modify files or execute scripts as defined in the referenced file.\n- Sanitization: No sanitization or integrity checks are performed on the ingested content.
Audit Metadata