pese
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and serves local file content, which constitutes an attack surface for indirect prompt injection if the files contain malicious instructions.\n
- Ingestion points: Local files or directories provided by the user as targets for sharing (SKILL.md).\n
- Boundary markers: The skill emphasizes pinning specific resources but does not define delimiters for the content of the files themselves.\n
- Capability inventory: The skill utilizes network tunneling tools (Tailscale, Tailcat) and may perform software installation if tools are missing.\n
- Sanitization: No sanitization is performed on the contents of the files being served, as the file content is served as-is.\n- [EXTERNAL_DOWNLOADS]: The skill directs users to official documentation and repositories for Tailscale and Tailcat for installation and usage guidance.\n
- Evidence: References official domains (tailscale.com) and repositories (github.com/tailscale/tailcat). These are well-known technology services.\n- [DATA_EXFILTRATION]: The skill's primary function is to make local data accessible over a network. While scoped to private transport (tailnets), this is a data exposure mechanism.\n
- Mitigation: The instructions explicitly mandate ephemeral server identities, rejection of sensitive directories (like .ssh or credentials), and immediate revocation after use to minimize risk.
Audit Metadata