document
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from research files and chat history which may contain untrusted content.
- Ingestion points: Reads content from the .agentflow/ directory and the active chat session history.
- Boundary markers: Lacks explicit delimiters or instructions to ignore embedded commands within the processed research files.
- Capability inventory: Performs file-write operations to project documentation paths and file-delete operations on source files in the .agentflow/ directory.
- Sanitization: While the skill includes a directive to 'Redact secrets', it lacks technical validation or escaping of the ingested text before it is written to the file system.
- [COMMAND_EXECUTION]: The skill performs file system modifications including file deletion as part of its core workflow.
- Evidence: Instructs the agent to 'Delete .agentflow/slug/ working files' once they have been processed into documentation.
Audit Metadata