agent-creator
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
scripts/init_agent.mjsscript is vulnerable to indirect prompt injection via schema confusion. It interpolates the user-provided--instructionsargument into a triple-quoted TOML string without escaping the"""delimiter. This allows an attacker (or a malicious user prompt) to terminate the instruction string and inject arbitrary TOML configuration keys. - Ingestion points: CLI arguments passed to
scripts/init_agent.mjs(specifically--instructions). - Boundary markers: The script uses triple quotes (
""") to encapsulate instructions but fails to sanitize the content for existing triple-quote sequences. - Capability inventory: The skill writes
.tomlfiles to.codex/agents/, which defines the capabilities (including tool access, MCP servers, and permissions) for future agent sessions. - Sanitization: The
normalizeMultilinefunction only handles newline character replacement and does not perform any escaping or validation of the TOML structure against injection.
Audit Metadata