paper-plan
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute Bash commands (
cat << 'EOF' > file) silently to write files in chunks if standard tools fail. This instruction explicitly tells the agent to bypass user permission and oversight for file system operations.- [DATA_EXFILTRATION]: The skill performs directory traversal to read files from a sibling directory (../shared-references/). It subsequently sends contents extracted from these and other local project files to an external model via the Codex MCP tool.- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. - Ingestion points: Untrusted research data is read from
NARRATIVE_REPORT.md,STORY.md,EXPERIMENT_LOG.md, and JSON files infigures/(SKILL.md). - Boundary markers: The skill lacks clear delimiters or instructions to ignore embedded commands when interpolating this data into prompts.
- Capability inventory: The agent has access to
Bash,Write,Edit, andWebSearchtools, which could be leveraged if an injection is successful. - Sanitization: There is no evidence of sanitization or validation of the external content before it is processed by the AI.
Audit Metadata