close-day
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external local files, specifically daily logs and vault configuration files (
AGENTS.md,SKILL.md), which creates a surface for indirect prompt injection if those files contain malicious instructions. However, the skill incorporates several mitigations that reduce the risk to a safe level.\n - Ingestion points: Processes content from
AGENTS.md,../vault/SKILL.md, and local daily note files.\n - Boundary markers: The instructions explicitly require the agent to "Preview the exact changes and obtain approval" and state that it must "Use only explicit user confirmation" before performing actions.\n
- Capability inventory: The skill is limited to reading and writing/updating files within the local vault directory.\n
- Sanitization: The workflow includes a mandatory verification step where the agent must reread the affected content to ensure all changes trace directly to user confirmation.\n- [NO_CODE]: The skill contains only natural language instructions for the agent and YAML configuration metadata. It does not include any scripts, binaries, or instructions to install third-party packages.
Audit Metadata