plexy-teach
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from various local workspace files, including MISSION.md, RESOURCES.md, GLOSSARY.md, learning-records, and NOTES.md, to inform lesson generation and state management. This creates a surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: The 'Start With Diagnosis' section of SKILL.md specifies reading all primary workspace metadata and history files.
- Boundary markers: The instructions do not define delimiters or specific 'ignore' directives to isolate processed workspace content from core instructions.
- Capability inventory: The skill can write multiple file types (HTML, Markdown) to the local file system and perform external research via network access.
- Sanitization: No explicit procedures for sanitizing or validating ingested workspace content are defined.
- [EXTERNAL_DOWNLOADS]: The skill and its fixtures reference official documentation from a well-known service for research and as learning material.
- Evidence: RESOURCES.md and the sample HTML lesson link to documentation on docs.python.org.
Audit Metadata