agents-wishlist
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read from and scan a local state file (
agents-wishlist.md) to identify recurring issues. This creates a vulnerability surface where malicious instructions could be embedded in the log file and subsequently processed by the agent. - Ingestion points: The agent reads from
$XDG_STATE_HOME/agents-wishlist.mdor~/.local/state/agents-wishlist.md(specified inSKILL.md). - Boundary markers: The skill uses Markdown headers and bullet points for structure but lacks explicit instructions to the agent to treat file content as data only and ignore any embedded instructions or control characters.
- Capability inventory: The skill utilizes file read and file write/append operations. In a live environment, the agent likely possesses broader capabilities (such as command execution) that could be targeted by an injection.
- Sanitization: The instructions include a requirement to redact secrets and sensitive data before writing, but there is no mechanism to sanitize the data against prompt injection during the read/scan phase.
Audit Metadata