toon-format
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides utility functions (
queryWithToon,analyzeWithClaude) that encode data objects into the TOON format and inject them directly into LLM prompts. This creates a surface for indirect prompt injection attacks where malicious data could override agent instructions. - Ingestion points: The
dataparameter inqueryWithToonandanalyzeWithClaudefunctions withinSKILL.md. - Boundary markers: The examples use markdown code blocks (triple backticks) as delimiters, which are a common but bypassable boundary mechanism.
- Capability inventory: The documentation demonstrates the capability to perform network requests to AI providers (OpenAI, Anthropic) and write to the local file system using Node.js
fsmodules. - Sanitization: The provided examples lack logic for sanitizing or validating the input data before it is encoded and sent to the LLM.
- [EXTERNAL_DOWNLOADS]: The skill instructions and documentation recommend installing several packages from the NPM registry.
- Evidence: The skill references
@toon-format/toon,gpt-tokenizer,express,@anthropic-ai/sdk, andopenai. These are standard dependencies for the library's stated purpose and integration with well-known AI services.
Audit Metadata