prompt-generator
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a transformer for untrusted user input, creating a potential surface for indirect prompt injection. However, it incorporates explicit instructions and checklists to mitigate this risk in the prompts it generates.\n
- Ingestion points: User input in the form of notes, bullet points, or brain dumps is ingested during the first step of the workflow defined in
SKILL.md.\n - Boundary markers: The skill's 'AI Self-Check' and 'Structuring Guidelines' mandate that untrusted source text be clearly delimited using labels or XML tags (e.g.,
<untrusted_source>) to prevent it from being misinterpreted as instructions.\n - Capability inventory: The skill is authorized to perform local file writes to
docs/local/prompts/to save the resulting prompt files, as specified inSKILL.md.\n - Sanitization: The agent is instructed to avoid treating source text as instructions and to include explicit 'anti-fabrication' and 'anti-hallucination' constraints when appropriate.\n- [SAFE]: A deterministic finding for prompt injection in
references/prompt-families.mdwas identified as a false positive. The string 'ignore previous instructions' appears within an educational counter-example used to explain how poor prompt design can lead to injection vulnerabilities, rather than being an actual injection attempt.\n- [SAFE]: The skill's file-writing functionality follows established security conventions, restricting operations to project-specific directories (docs/local/prompts/) and ensuring that actions are driven by explicit user intent or authorized workflow steps.
Audit Metadata