close
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to "Read back over the whole session" to identify "loose ends" such as promises made or failed tool calls. Since the session history can include content from untrusted external sources (e.g., website content, third-party files), this creates a vulnerability to indirect prompt injection where an attacker could influence the cleanup process.
- Ingestion points: The agent is directed to scan the entire session history (Step 1 in SKILL.md).
- Boundary markers: There are no instructions to differentiate between user-originated commands and data retrieved from external sources within the session history.
- Capability inventory: The skill empowers the agent to execute commands, write files, and modify system documentation ("canon") based on its findings (Step 3 and Step 3b in SKILL.md).
- Sanitization: The instructions do not specify any validation or sanitization of the identified tasks before the agent attempts to "close" them.
Audit Metadata