skill-extract
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and analyzing untrusted external data from local directories and remote URLs. This architecture is susceptible to indirect prompt injection, where an attacker could place malicious instructions inside a codebase to manipulate the extraction process or the agent's summary.
- Ingestion points: The tool accepts local paths (e.g.,
./my-app) and remote URLs (e.g.,https://example.com) for analysis as described in SKILL.md. - Boundary markers: There are no documented delimiters or instructions to ignore embedded prompts within the ingested source code or site content.
- Capability inventory: The skill utilizes AST parsing, file system writes (generating the
octopus-extract/directory), and multi-AI consensus mechanisms to process data. - Sanitization: The documentation does not describe any sanitization or filtering logic applied to the external data before it is interpreted by the AI providers.
Audit Metadata