draft-project-charter
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data (such as emails, briefs, and proposals) to extract information and fill out a project charter template, creating an indirect prompt injection surface.
- Ingestion points: Step 1 requires reading existing project documentation, proposals, briefs, and emails to gather project context.
- Boundary markers: Absent. The instructions do not prescribe any special delimiters or escaping mechanisms to prevent instructions inside the documents from influencing the agent's behavior.
- Capability inventory: The frontmatter allows tools such as
Read,Write,Edit,Bash,Grep, andGlob. The procedure utilizes file-writing capabilities to generate a markdown file (PROJECT-CHARTER-[PROJECT-NAME].md). - Sanitization: Absent. No logic or instruction is provided to filter, sanitize, or validate the contents of the ingested project documents before interpolation.
Audit Metadata