write
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted external data.
- Ingestion points: The skill ingests user-supplied prose for editing and review (in
SKILL.md) and fetches "voice profiles" from external URLs or local paths provided in the request or environment variables. - Boundary markers: While the skill provides persona constraints (e.g., "Return only improved text"), it lacks explicit delimiters or instructions to the model to ignore potential commands embedded within the input prose or the fetched voice profiles.
- Capability inventory: The skill has the capability to read local files (defaulting to
~/.claude/writing-voices/) and fetch content from arbitrary URLs to load style profiles. It also coordinates with other models/subagents for drafting tasks. - Sanitization: There is no evidence of content sanitization or validation for the data retrieved from external URLs or local files before it is interpolated into the agent's instructional context.
Audit Metadata