retail-operating-model-srs
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill's metadata incorrectly identifies it as
portable: true. This claim is contradicted by the hardcoded absolute Windows filesystem path (C:\wamp64\www\chwezi-accounting-doctrine) used in Step 3 of the core workflow. This contradiction can mislead users regarding the skill's requirements and operational environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data from project context and domain reference files, creating a surface for indirect prompt injection attacks.
- Ingestion points: The skill reads from
projects/<ProjectName>/_context/in Step 1 and various files withindomains/retail/references/in Steps 2 and 3. - Boundary markers: The instructions lack specific boundary markers or "ignore embedded instructions" delimiters when processing these external files.
- Capability inventory: The skill is limited to read, search, and editing named requirements artefacts. It does not perform network operations or high-risk command execution, which limits the potential impact of an injection.
- Sanitization: No sanitization, validation, or filtering of the ingested content is specified in the workflow.
Audit Metadata