polyscan-repo-discovery
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web and stores it in a local file, which could contain malicious instructions designed to influence downstream processes.
- Ingestion points: Data returned from
WebSearchandgeneral-purposesub-agent responses, specifically repository URLs, star counts, and descriptions ('why' field) (found inSKILL.md). - Boundary markers: Absent; the skill appends discovery results to
.polyscan/audit/queue.mdas standard Markdown list items without using specific delimiters or 'ignore' instructions to isolate the untrusted content. - Capability inventory: The skill possesses the capability to read from and write to the local filesystem (
.polyscan/audit/queue.md) and trigger sub-agent execution. - Sanitization: Absent; there is no mention of sanitizing, escaping, or validating the strings (such as the 'why' reason) retrieved from external web sources before they are persisted to the queue file.
Audit Metadata