skill-intent-contract
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill captures untrusted user input (such as goals, success criteria, and boundaries) and persists it in a
session-intent.mdfile. This file is intended to be read back into the agent's context at multiple stages of the workflow (Step 3: Reference and Step 4: Validate), creating an indirect prompt injection vector. - Ingestion points: The variables
${USER_GOAL},${MIN_SUCCESS_CRITERIA},${EXCEPTIONAL_CRITERIA},${BOUNDARIES},${STAKEHOLDERS}, and${TIMELINE}inSKILL.md(Step 2). - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the recovered content as untrusted or to ignore embedded instructions within the contract file.
- Capability inventory: The skill utilizes file writing (
cat >) and external script execution (plan-storage.sh). - Sanitization: The instructions do not specify any validation or escaping of user-provided content before interpolation into the markdown file or the shell command.
- [COMMAND_EXECUTION]: The implementation instructions for "Step 2: Write Intent Contract File" suggest a shell-based heredoc pattern (
cat > ... <<EOF) for writing user data. If the environment variables containing user input are expanded by a shell without prior escaping, this pattern is vulnerable to command injection (e.g., if${USER_GOAL}contains backticks or subshell syntax).
Audit Metadata