writing-fragments
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface for indirect prompt injection because it reads untrusted data from a user-managed markdown file and re-ingests it into the agent's context. This is a functional requirement to ensure the agent respects manual user edits to the file.
- Ingestion points: Per the instructions in SKILL.md, the agent re-reads the fragments file from disk before every write operation.
- Boundary markers: There are no explicit instructions or delimiters used to separate user-provided fragments from potentially malicious instructions that could be placed in the file.
- Capability inventory: The skill possesses local file system read and write permissions to manage the fragment document.
- Sanitization: No validation or sanitization is performed on the text read from the disk before it is placed back into the prompt context.
- [NO_CODE]: The skill does not include any executable scripts, binaries, or external dependencies. Its functionality is defined entirely through markdown instructions and YAML configuration.
Audit Metadata