book-chunk
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted book content and interpolates it into a prompt for context generation using an LLM.
- Ingestion points: Step 1 and 2 involve reading external Markdown files (
<book-slug>-ch*.md) and manifest files. - Boundary markers: The skill uses XML-style delimiters (
<chunk text>) in the prompt template to separate instructions from data, which provides a basic level of protection but does not fully eliminate the risk of adversarial content. - Capability inventory: The agent has access to
Read,Write,Bash,Grep, andGlobtools, which could potentially be misused if an injection successfully compromised the agent's logic flow. - Sanitization: The skill employs Zod schema validation for frontmatter metadata, but does not specify sanitization or filtering logic for the actual text content of the book chunks before they are sent to the LLM.
Audit Metadata