write-comparison-article-create

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python validation script (scripts/check_comparison.py) and the hugo binary. These operations are intended for validating markdown structure, checking internal links, and verifying that the generated content renders correctly within the static site framework. The Python script utilizes subprocess.run with list-style arguments, which follows security best practices to prevent command injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it instructs the agent to research facts from external websites (official documentation, pricing pages) and ingest them into the article drafting process.
  • Ingestion points: Research data from external web sources and local project configuration files (writing-style.md, AGENTS.md) are ingested into the agent context.
  • Boundary markers: The skill does not explicitly define delimiters or specific instructions for the agent to ignore potentially malicious embedded instructions in researched data.
  • Capability inventory: The agent has the ability to read and write files within the project directory and execute local commands (python3, hugo).
  • Sanitization: The workflow suggests the optional use of an ai-sanitize plugin to clean the generated output of common AI linguistic markers before delivery.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 03:18 PM