sgc-electron-app-relaunch
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The README.md recommends executing a utility script (
scripts/validate_skill.py) to verify the skill's structural integrity and metadata hygiene. The script performs safe static analysis, including YAML parsing and regex-based validation of skill contents. - [INDIRECT_PROMPT_INJECTION]: The skill documentation includes a 'General Feedback Loop' (通用反馈闭环) which instructs the agent to process user feedback to potentially update its own instructions.
- Ingestion points: User-provided feedback and suggested changes provided during the session are evaluated for incorporation into the SKILL.md file.
- Boundary markers: The workflow specifies that the agent must stop and await explicit user confirmation after preparing changes and before any external file writing or publishing occurs.
- Capability inventory: The agent is guided to modify local instruction files, which involves file-system write capabilities.
- Sanitization: The instructions emphasize verification and linting of the final instruction set, though they do not specify detailed sanitization for the feedback input strings themselves.
Audit Metadata