jinko-document
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local markdown files and JSON manifests. It provides explicit instructions for the AI agent to treat this content strictly as data and to ignore any embedded instructions. This safety boundary is reinforced by the eval suite (eval id 2) which tests resistance to instruction overrides. Capability is limited to Jinkō API calls via the SDK.
- [DATA_EXFILTRATION]: While the skill reads local files, it implements rigorous sanitization in the bundled scripts. The resolve_local_file function in scripts/create_document_from_markdown.py uses pathlib to enforce strict path containment relative to an authorized root, preventing directory traversal. Furthermore, validate_image_file verifies file magic bytes for GIF, JPEG, PNG, WEBP, and SVG formats to ensure that non-image sensitive files cannot be uploaded.
- [EXTERNAL_DOWNLOADS]: The skill relies on the jinko Python SDK. Since the author is novainsilico and the SDK is their official platform resource, this is documented as a trusted vendor dependency.
- [COMMAND_EXECUTION]: Document creation and updates are managed by bundled Python scripts. These scripts implement a secure manual approval system requiring a SHA-256 digest (--confirm-digest) of the dry-run manifest before any state-changing Jinkō API calls are executed.
Audit Metadata