workspace-surface-audit
Warn
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is instructed to audit the "environment surface" by reading ".env" files to identify available services. Accessing sensitive files that typically contain credentials poses a data exposure risk.
- Evidence: The "Audit Inputs" section specifies reading ".env*" files in the active repo and adjacent ECC workspaces to find key names like "STRIPE_API_KEY", "TWILIO_AUTH_TOKEN", and "FAL_KEY".
- Mitigation: The skill includes a non-negotiable rule stating: "Never print secret values. Surface only provider names, capability names, file paths, and whether a key or config exists."
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads and processes untrusted repository files which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The audit process reads "package.json", lockfiles, "README.md", ".mcp.json", ".lsp.json", "AGENTS.md", "GEMINI.md", and other install manifests.
- Boundary markers: Absent; there are no instructions for the agent to use specific delimiters or to ignore instructions embedded within the audited files.
- Capability inventory: The skill is restricted to inventorying and benchmarking; it does not contain instructions for subprocess calls, file writes, or network operations.
- Sanitization: Absent; the content of the ingested files is processed without specific validation, filtering, or escaping.
Audit Metadata