book-chunk

Pass

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted book content and interpolates it into a prompt for context generation using an LLM.
  • Ingestion points: Step 1 and 2 involve reading external Markdown files (<book-slug>-ch*.md) and manifest files.
  • Boundary markers: The skill uses XML-style delimiters (<chunk text>) in the prompt template to separate instructions from data, which provides a basic level of protection but does not fully eliminate the risk of adversarial content.
  • Capability inventory: The agent has access to Read, Write, Bash, Grep, and Glob tools, which could potentially be misused if an injection successfully compromised the agent's logic flow.
  • Sanitization: The skill employs Zod schema validation for frontmatter metadata, but does not specify sanitization or filtering logic for the actual text content of the book chunks before they are sent to the LLM.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 25, 2026, 03:02 AM
Security Audit — agent-trust-hub — book-chunk