m4l-project
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform local validation and deployment tasks, including running
node --checkandpython3 -m py_compileon project source files, and managing.amxdfiles within the Ableton User Library path. These operations are limited to the local development environment and are standard for the skill's intended purpose of managing M4L projects. - [INDIRECT_PROMPT_INJECTION]: The skill ingests various project files that could serve as a vector for indirect instructions. 1. Ingestion points: The agent processes
.maxpat,.amxd,.js,.py, andDESIGN.mdfiles located in the project's subdirectories. 2. Boundary markers: No specific delimiters or instructions to ignore embedded content are defined in the skill instructions. 3. Capability inventory: The agent can execute linting/validation commands (node,python3) and modify files in specific local directories. 4. Sanitization: No explicit sanitization or filtering logic is provided for the contents of the ingested project files.
Audit Metadata