commenting-content
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill involves running local Python scripts (
inject-comments-docx.pyandinject-comments-pptx.py) via the command line to modify document files. This is a standard part of the skill's workflow, but involves direct shell interaction. - Indirect Prompt Injection: The skill is designed to ingest and analyze untrusted data from user-uploaded
.docxand.pptxfiles. This creates a potential surface where instructions embedded within these documents could attempt to influence the agent's behavior. - Ingestion points: Untrusted data enters the agent context via the
Analyze skillwhen processing the main document content and raw XML (word/document.xml,ppt/slides/slide{N}.xml). - Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the analyzed document text.
- Capability inventory: The skill possesses the capability to write to the filesystem and execute Python scripts via the shell (
scripts/inject-comments-docx.py,scripts/inject-comments-pptx.py). - Sanitization: While the scripts use XML escaping for comment text, the core logic relies on raw text extraction, which does not filter for potential prompt injection attempts within the document body.
Audit Metadata