pm-evidence-audit
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external documents, reports, and web content provided by the user or discovered via search tools. This creates an attack surface where instructions embedded within the analyzed materials could attempt to manipulate the agent's behavior during the audit process.
- Ingestion points: Processes user-supplied documents, links, and text snippets via the
Readtool as specified inSKILL.md("接受用户给出的报告、片段、可访问的文档路径或资料链接"). - Boundary markers: The instructions do not define specific delimiters or explicit "ignore embedded instructions" commands to separate user data from the core system prompts.
- Capability inventory: The skill is granted
Writeaccess to the filesystem (though instructions require user confirmation) andWebSearchcapabilities for external verification. - Sanitization: There are no explicit instructions for sanitizing, escaping, or filtering content retrieved from external sources or search results before it is incorporated into the agent's reasoning context.
Audit Metadata