dont-to-do
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input from the
$ARGUMENTSvariable to identify and rewrite prompt constraints. There is an inherent risk that maliciously crafted user input could attempt to influence the agent's behavior during the transformation phase. - Ingestion points: User input is ingested in
SKILL.md(Step 2) and passed to a local script. - Boundary markers: The skill employs a structured three-phase pipeline (SCAN, TRANSFORM, BACKFILL) and provides the LLM with specific, quantified transformation strategies for twelve distinct categories of constraints to maintain control over the output.
- Capability inventory: The skill uses the
Bashtool to execute a local, dependency-free Python script (scripts/refine.py) for regex-based constraint detection and text splicing inSKILL.md(Steps 2 and 4). - Sanitization: To mitigate potential command injection risks when handling special characters in user input, the skill instructs the agent to write generated transformations to a temporary JSON file (
/tmp/_dtd_backfill_$RANDOM.json) rather than passing them as direct shell arguments.
Audit Metadata