draft-brief
Pass
Audited by Gen Agent Trust Hub on May 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to save an HTML file to the local filesystem and then automatically open it in the user's web browser. This involves the execution of a system command to launch the browser application.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing and rendering untrusted data from the local repository into an HTML document.
- Ingestion points: The agent is instructed to read file contents, diffs, and commit history from the working tree (SKILL.md, Step 1).
- Boundary markers: The instructions do not provide explicit boundary markers or warnings to ignore instructions embedded within the source files being summarized.
- Capability inventory: The agent has the capability to write files to the
.briefs/directory and execute a command to open the browser (SKILL.md, Step 5). - Sanitization: There is no explicit requirement in the instructions to sanitize or escape the repository content (such as commit messages or file diffs) before embedding it into the HTML structure, which could lead to script execution if the repository contains malicious HTML or JavaScript.
Audit Metadata