letterboxd-diary
Warn
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: MEDIUMPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The skill instructs the agent to offer to store the Letterboxd username by exporting an environment variable in the user's shell profile (e.g., ~/.bashrc, ~/.zshrc). While intended for configuration, modifying shell startup files is a persistence mechanism.
- [PROMPT_INJECTION]: The 'Retrieval ladder' in Section 2 includes instructions (Rung 3) for the agent to bypass host-level security policies that restrict fetching URLs originating from skill files. It directs the agent to have the user paste the URL back into the conversation to satisfy provenance checks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external Letterboxd RSS feeds, creating a surface for indirect instructions.
- Ingestion points: RSS feed fetched via curl from https://letterboxd.com//rss/ (SKILL.md Section 2).
- Boundary markers: The skill does not define specific boundaries or instructions to ignore embedded prompts within the film titles or reviews.
- Capability inventory: The agent renders titles, links, and reviews into Markdown; it does not perform sensitive operations on this data.
- Sanitization: The instructions include stripping HTML tags and converting paragraphs to plain text (SKILL.md Section 6).
- [COMMAND_EXECUTION]: The skill utilizes curl with specific flags (-sSf) to fetch data from letterboxd.com.
- [EXTERNAL_DOWNLOADS]: The skill fetches RSS feed data from letterboxd.com, which is a well-known service.
Audit Metadata