ask-ai
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The script 'scripts/browser_capture_artifacts.py' executes local 'git' commands (such as 'rev-parse' and 'check-ignore') using non-shell 'subprocess.run' calls. This is used solely to verify that review artifacts are stored within a valid and correctly ignored Git repository, preventing accidental versioning of temporary files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external AI providers and web pages. It proactively mitigates this risk through a mandatory 'Quarantine Phase' and the 'untrusted-review-data/v1' contract defined in 'references/untrusted-content.md', which treats all external input as non-executable data. \n
- Ingestion points: External AI responses and web pages (documented in 'references/untrusted-content.md'). \n
- Boundary markers: Data-only envelopes and explicit quarantine instructions. \n
- Capability inventory: Local file operations and Git status checks in 'scripts/browser_capture_artifacts.py'. \n
- Sanitization: Automated redaction of PII, secrets, and URLs in metadata and logs in 'scripts/record_feedback.py'.
- [DATA_EXFILTRATION]: The skill handles potentially sensitive metadata during AI round synchronization and feedback logging. However, it employs strict data boundaries in 'references/final-result-sync.md' and 'scripts/record_feedback.py' that redact PII, credentials, and raw source excerpts before any data is logged or transmitted.
Audit Metadata