suggesting-path-cleaning-rules
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (sampled website pathnames) which is then passed to an LLM to generate configuration rules. This architecture is susceptible to indirect prompt injection if a malicious user creates pathnames designed to manipulate the LLM's logic.
- Ingestion points: The
sample_pathnamesfunction inservice.pyfetches raw$pathnamevalues from web analytics traffic. - Boundary markers: The documentation does not specify if the prompt templates use delimiters or explicit instructions to prevent the LLM from executing commands found within the sampled pathnames.
- Capability inventory: The skill utilizes an LLM gateway, performs regex compilation via the
re2engine, and includes tools to modify project-levelpath_cleaning_filters. - Sanitization: Rules are validated for syntax and matches using
re2before storage, but the skill does not mention sanitizing the input pathnames to filter out potential injection strings before they reach the LLM.
Audit Metadata