etc-lgnh
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bun runto execute local TypeScript scripts (scripts/prepare-humanize-input.tsandscripts/verify-change-rate.ts) for text processing and quality control. These executions are scoped to local file paths provided by the user and are intended for the skill's primary function of text analysis and rewriting. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided text for 'humanization' and translation tasks.
- Ingestion points: User-supplied strings via the
--textargument or file contents via the--fileargument in theprepare-humanize-input.tsscript. - Boundary markers: The script wraps metadata and cleaned text in specific HTML comments (
<!-- METRICS-START ... METRICS-END -->) to separate processing data from content. - Capability inventory: The skill can read and write files within the local environment (specifically in the
_workspacedirectory) and generate static HTML artifacts for explanations. - Sanitization: The
sanitizeTextfunction inprepare-humanize-input.tsproactively removes invisible/special characters (zero-width spaces, etc.) and common AI chatbot headers/footers to normalize input and mitigate accidental instruction following. - [OBFUSCATION]: The
scripts/prepare-humanize-input.tsscript contains defensive regex patterns to detect and remove hidden characters (Unicode tags, zero-width spaces, etc.) from input text, acting as a security measure to ensure input cleanliness before processing.
Audit Metadata