aif-reference
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches content from external URLs and local files to generate documentation, creating an attack surface for indirect prompt injection where malicious instructions in the source material could manipulate the AI's output or behavior to process unauthorized information.\n
- Ingestion points: Untrusted web content via
WebFetch(including up to 8 sub-pages), local documents viaRead(with recursive inclusion up to 5 levels), and project-specific rules from.ai-factory/skill-context/aif-reference/SKILL.md.\n - Boundary markers: The skill does not define clear delimiters or use system instructions to ignore embedded commands within the fetched data.\n
- Capability inventory: The skill is permitted to
WriteandEditfiles and perform restricted filesystem operations viaBash.\n - Sanitization: There is no evidence of data sanitization or input validation for the external content before it is processed for synthesis.\n- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute shell commands (mkdir -p,ls,wc) for managing the references directory and indexing files. While the set of allowed commands is limited, it enables direct interaction with the host filesystem.
Audit Metadata