blog-idea-generator
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill gathers business context by reading multiple files from the local filesystem, including documentation in
docs/and source content insrc/pages/en/blog/. If these files contain content from external or untrusted sources, they could facilitate indirect prompt injection attacks.\n - Ingestion points:
SKILL.md(Step 1) instructs the agent to read all files indocs/en/,docs/sector-brief.md,docs/style-brief.md, and articles insrc/pages/en/blog/. The workflow also mentions reading website content.\n - Boundary markers: The instructions lack boundary markers (e.g., XML tags or specific delimiters) or system-level instructions to ignore embedded prompts within the ingested text.\n
- Capability inventory: The agent is expected to perform file read/write operations and is suggested to use shell commands for line count verification.\n
- Sanitization: There is no mention of sanitizing or validating the input data before it is processed by the LLM.\n- [COMMAND_EXECUTION]: The
Quality ChecklistinSKILL.mdinstructs the agent to verify the line count of the skill file using thewc -lcommand. While this specific command is benign, it demonstrates the skill's intent to trigger local shell execution.
Audit Metadata