toon-format

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides utility functions (queryWithToon, analyzeWithClaude) that encode data objects into the TOON format and inject them directly into LLM prompts. This creates a surface for indirect prompt injection attacks where malicious data could override agent instructions.
  • Ingestion points: The data parameter in queryWithToon and analyzeWithClaude functions within SKILL.md.
  • Boundary markers: The examples use markdown code blocks (triple backticks) as delimiters, which are a common but bypassable boundary mechanism.
  • Capability inventory: The documentation demonstrates the capability to perform network requests to AI providers (OpenAI, Anthropic) and write to the local file system using Node.js fs modules.
  • Sanitization: The provided examples lack logic for sanitizing or validating the input data before it is encoded and sent to the LLM.
  • [EXTERNAL_DOWNLOADS]: The skill instructions and documentation recommend installing several packages from the NPM registry.
  • Evidence: The skill references @toon-format/toon, gpt-tokenizer, express, @anthropic-ai/sdk, and openai. These are standard dependencies for the library's stated purpose and integration with well-known AI services.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 08:37 PM
Security Audit — agent-trust-hub — toon-format