de-ai-documents
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingest and rewrites untrusted user-supplied documents such as Jupyter notebooks, reports, and source code. This process is susceptible to indirect prompt injection where malicious instructions embedded in a document could be executed by the agent while it performs analysis or rewriting tasks.\n
- Ingestion points: Document auditing workflow in SKILL.md and file parsing in scripts/audit_tells.py.\n
- Boundary markers: The instructions do not define delimiters or explicit warnings to ignore embedded commands within the artifacts being processed.\n
- Capability inventory: The skill involves file writing for document modification and recommends re-executing notebooks or recompiling code to rebuild execution traces.\n
- Sanitization: No sanitization, escaping, or validation of external content is described before the agent operates on the artifacts.\n- [COMMAND_EXECUTION]: The skill's operational workflow requires the agent to execute a local Python script for diagnostics and suggests re-executing notebook kernels to generate authentic-looking execution timestamps.\n
- Evidence: SKILL.md explicitly instructs the agent to run
scripts/audit_tells.pyfor a mechanical first pass and provides methods for pacing notebook cell execution in the 'Rebuild the traces' section.
Audit Metadata