rewrite-natural-prose
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill implements a persistent 'rewriting mode' by modifying host instruction files like
AGENTS.md(Codex) andCLAUDE.md(Claude). This allows the skill's instructions to influence the agent's behavior across different tasks and sessions within a workspace or client environment. - [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (
scripts/manage-rewrite-policy.mjs) to manage these configuration files. The agent is instructed to execute this script to check, preview, enable, or disable persistent modes based on user requests. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prose for refinement, creating an attack surface for instructions embedded in data to influence the agent.
- Ingestion points: User passages provided for rewriting in
SKILL.md. - Boundary markers: Present; the skill instructs the agent to treat quoted prose as data and separate editable text from technical content.
- Capability inventory: Execution of the
manage-rewrite-policy.mjsscript which can modify persistent agent configuration files. - Sanitization: Present; the agent is directed to use structure checks and preserve technical fields (macros, EJS, variable paths, regex) literally without rewriting them.
- [SAFE]: The file modification script includes robust security controls: it enforces absolute paths, rejects symbolic links, restricts writes to specific host-approved filenames, and implements a multi-step 'preview and approve' workflow using unique operation tokens and mandatory backups to prevent unauthorized or accidental modifications.
Audit Metadata