write
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) due to its core functionality of ingesting and processing untrusted content.
- Ingestion points: The skill ingests user-supplied prose for editing and is instructed to load voice profiles from arbitrary paths or URLs provided in the request (
SKILL.md). - Boundary markers: No delimiters or safety instructions are provided to the agent to prevent it from obeying instructions embedded within the processed text or profiles.
- Capability inventory: The skill generates rewritten text and can dispatch subagents to powerful models for drafting (
SKILL.md,references/fable-drafting.md). - Sanitization: The skill does not implement any validation or sanitization for the input prose or the loaded voice profiles.
- [DATA_EXFILTRATION]: The skill instructions direct the agent to access files in
~/.claude/writing-voices/and resolve paths from the$WRITE_VOICES_DIRenvironment variable. While this is the intended storage for the feature, it involves reading sensitive personal data (real writing samples from Slack, email, etc.) from a hidden application configuration directory.
Audit Metadata