intranet
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted workspace documents and 'module.json' manifests as context for an AI advisor component, creating a potential surface for instructions embedded in data to influence agent behavior.\n
- Ingestion points: The skill scans the entire workspace for
module.jsonmanifests and reads every 'canonical document' present in the stones (Step 1 and Step 5).\n - Boundary markers: No explicit boundary markers or 'ignore' instructions are specified to separate external document content from the advisor's system instructions.\n
- Capability inventory: The skill reads local workspace files, updates the root
CLAUDE.mdconfiguration file, starts a Node.js server, and performs network operations via the Claude API.\n - Sanitization: No sanitization, filtering, or validation of the content of the canonical documents is mentioned before they are processed by the advisor.\n- [DATA_EXFILTRATION]: The advisor component loads all present canonical documents and sends their content to the Claude API for processing. While this is a primary intended function, it represents a data flow from the local filesystem to an external network service.\n- [COMMAND_EXECUTION]: The skill involves starting a Node.js server on port 4000 to host the intranet shell and API route, and performs build operations for module sites which involves local command execution.
Audit Metadata