tour-system
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the user's repository, including source code and documentation, to build learning tours. While this introduces a potential attack surface where malicious files could influence the agent's output, the skill mitigates this by enforcing an 'Iron Law' that requires all claims to be verified against source, test, or runtime evidence.
- Ingestion points: Consuming-repo files (source/tests), docs/specs/INDEX.md.
- Capability inventory: File reads, directory writing, git command execution.
- Sanitization: Not explicitly implemented, but verification requirements reduce impact.
- [COMMAND_EXECUTION]: The skill uses local shell commands, specifically
git check-ignore, to verify the configuration of the repository environment. This is a standard practice for managing tool-specific data directories. - [DATA_EXFILTRATION]: The skill writes learning progress and ledgers to a local
.skills/directory. It includes a mandatory preflight check to warn the user if this directory is not properly excluded from version control, protecting against accidental data leakage via git commits.
Audit Metadata