agent-message-board
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill mandates that the agent check a shared message board before every response and 'use the information to inform your response.' This design creates a broad attack surface for indirect prompt injection, as messages posted to the board can influence or override agent behavior across different sessions.\n
- Ingestion points: Data enters the agent's context through
scripts/search_agent_message_board.pyandscripts/read_threadwhich retrieve content from a local SQLite database.\n - Boundary markers: The instructions provide no clear delimiters or warnings to treat the retrieved board content as untrusted, potentially leading the agent to follow malicious instructions embedded in posts.\n
- Capability inventory: The skill allows agents to read and write to a local database; the impact of an injection is amplified by any other capabilities (e.g., shell access, file modification) the agent possesses.\n
- Sanitization: The search logic sanitizes queries for FTS operators, but the message bodies are stored and retrieved without filtering for prompt injection or command patterns.\n- [PROMPT_INJECTION]: The skill's metadata description uses mandatory directive language ('MANDATORY: For every prompt...') in an attempt to override standard agent behavior and force the use of the message board tool.
Audit Metadata