state
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism for storing and retrieving shared state using "opaque JSON" values, which creates a surface for indirect prompt injection. Malicious instructions embedded in stored data could potentially influence the behavior of reactive functions that process these updates.
- Ingestion points: Data enters the agent's context through the
state::setandstate::updatefunctions defined inSKILL.md. - Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands within the stored JSON values.
- Capability inventory: The system allows for asynchronous execution of handlers (e.g.,
orders::on-status-change) via reactive triggers triggered by state mutations. - Sanitization: No evidence of sanitization, validation, or escaping of the stored content is provided, increasing the risk that downstream handlers will interpret data as instructions.
Audit Metadata