writing-fragments
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is instructed to re-read a user-specified Markdown file from disk before every write operation to preserve user edits. This ingestion of external data creates a surface for indirect prompt injection, where malicious instructions hidden in the text file could be interpreted by the agent as commands during the writing session.
- Ingestion points: Data enters the agent context through the user conversation and the content read from the local file system (SKILL.md).
- Boundary markers: The skill uses horizontal rules (
---) to separate fragments but does not include explicit instructions to ignore or escape commands embedded within the fragments. - Capability inventory: The skill possesses file read and write capabilities on the local file system.
- Sanitization: No content sanitization or validation is implemented for the data read from disk.
Audit Metadata