blog-discourse
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted content from social platforms and forums via WebSearch snippets, which presents a surface for indirect prompt injection.\n
- Ingestion points: Phase 3 collects snippets from WebSearch results (Reddit, X, HN, etc.).\n
- Boundary markers: Includes an 'Untrusted-Data Contract' (Phase 3.5) that specifies the use of prefixes like '[SUSPICIOUS-SNIPPET]' for untrusted content and references orchestrator-level fences.\n
- Capability inventory: The skill writes to the file system (DISCOURSE.md) and executes a local Python script to process data.\n
- Sanitization: Implements explicit pattern matching for common injection vectors (e.g., 'ignore previous', 'exfiltrate') in snippets before they are processed by the reporting script.\n- [COMMAND_EXECUTION]: The skill utilizes local command execution to manage data and generate reports.\n
- Evidence: Runs a
python3 -ccommand to generate secure temporary file paths with restricted permissions (0600).\n - Evidence: Invokes a local helper script
scripts/discourse_research.pyto aggregate results into the final Markdown brief.
Audit Metadata