walkthrough
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process lists of items from potentially untrusted sources such as external files or past conversation turns, which presents an injection surface.
- Ingestion points: Step 1 in SKILL.md defines that items can be sourced from user-named files (e.g., 'subtasks.json'), conversation findings, or inline lists.
- Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the items being walked through.
- Capability inventory: The skill defines an 'edit' control in SKILL.md that instructs the agent to 'Actually apply the change (file edit, rewrite, whatever the item implies)'. This provides a direct path for data in the items to influence file system modifications.
- Sanitization: The instructions lack requirements for sanitizing or validating item content before the agent executes the 'edit' operation.
Audit Metadata