fable-spark

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill package is composed entirely of markdown documentation, YAML configurations, and JSON evaluation data. It does not include any executable scripts, shell commands, or external package dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest workspace metadata, such as mutation generations and failure streaks from state files like .fable/state.json and LEDGER.md, to generate its suggestions. While this creates a dependency on potentially untrusted workspace data (ingestion points), the skill lacks any capabilities for file writing, system mutation, or network communication (capability inventory), and does not process external user-generated content that could lead to command execution. The absence of boundary markers or sanitization is mitigated by the skill's purely evaluative and non-executable nature.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 06:44 PM