automate-me
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill derives new instructions by mining workspace-scoped conversation history and existing repository instructions. This creates a surface for indirect injection where malicious content in processed data could potentially influence the configuration of the generated agent mode.
- Ingestion points: Conversation transcripts and existing instruction files (
*-mode/SKILL.md) within the active workspace. - Boundary markers: The skill instructions require 'evidence pointers' and pattern promotion across time slices, but do not specify technical delimiters to separate untrusted data from the prompt context.
- Capability inventory: The skill is capable of writing new markdown instruction files (
SKILL.md) to the local repository and delegating tasks to subagents. - Sanitization: No explicit escaping or filtering of characters or instructions found in the mined history is described.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill identifies and processes sensitive workspace data such as conversation history and project-specific rules. However, it contains explicit security policies forbidding agents from using external communication tools (email, chat, social media) and mandates that all output be left as local files or drafts for user review.
Audit Metadata