engineering-blog-post
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a provided local bash script,
scan-draft.sh, to identify marketing superlatives and unverified claims in drafts. The script is restricted to performing local text processing using standard utilities likegrepandsedand does not initiate network connections or access sensitive system directories. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted 'raw material' such as incident notes, pull requests, and support threads to generate content.
- Ingestion points: External data enters the context through the 'Interview' and 'Workflow' processes described in
SKILL.md. - Boundary markers: The skill lacks explicit instructions or delimiters to isolate the agent from potential prompt injections embedded within the ingested raw materials.
- Capability inventory: The agent has the capability to execute local bash scripts and invoke other platform skills (e.g., humanizers).
- Sanitization: The skill incorporates a redaction pass specifically for incident-derived posts to remove internal identifiers, though this is primarily for privacy rather than injection prevention.
Audit Metadata