oh-pdd-code-generator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided design documents (
{功能设计文档}) to drive its analysis and generation workflow. This creates a vulnerability surface where a malicious document could contain instructions to override the agent's behavior or exfiltrate data discovered during the analysis phase. - Ingestion points: The agent ingests functional design documents as the primary input for generating code frameworks, as specified in
SKILL.md. - Boundary markers: The skill lacks explicit boundary markers or instructions that tell the agent to treat the design document strictly as data and to ignore any embedded natural language instructions.
- Capability inventory: The skill uses
Glob,Grep, andReadtools to explore the local filesystem, as well as aTasktool to perform more complex exploration. These capabilities could be abused if an injection in a design document directs the agent to search for or read sensitive files (e.g., credentials or configuration files) that are not part of the source code analysis. - Sanitization: There is no evidence of input validation, filtering, or sanitization of the content within the ingested design documents.
Audit Metadata