first-reader
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted draft files by passing text chunks to subagents acting as reader personas. This presents a vulnerability surface where a maliciously crafted draft could attempt to override the subagent's roleplay instructions or manipulate the recall and reporting outcomes.\n
- Ingestion points: Untrusted draft content is read by
feed.py,skim.py, andsignals.pyfrom the local file system.\n - Boundary markers: The skill uses passage headers/footers in
feed.pyand provides grounding instructions (e.g., 'Answer only from this log') to subagents.\n - Capability inventory: The skill performs local file operations and runs a loopback HTTP server (127.0.0.1) using authentication tokens for inter-process communication; no external network access is requested or performed.\n
- Sanitization: The HTML generation logic in
room.pyescapes prose content using standard HTML escaping to prevent injection in the generated report.
Audit Metadata