burn-tokens-fast
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a mechanism to ingest and store user-supplied activity descriptions, creating a potential surface for indirect prompt injection.
- Ingestion points: The 'Record Another Activity' section in
SKILL.mddefines how the agent should process user input to extend the activity catalog. - Boundary markers: The instructions lack explicit delimiters or guidance to treat user-provided content as untrusted data, which could lead the agent to follow instructions embedded in new catalog entries.
- Capability inventory: The nature of the activities described (e.g., dependency updates, style unification, Docker image slimming) suggests the agent has access to development tools, shell execution, and file system operations.
- Sanitization: No sanitization or validation logic is defined to inspect user-provided content before it is added to the catalog.
Audit Metadata