cowork-plugin-customizer
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external documentation, repository evidence, and existing codebase content, which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Untrusted data enters the context via the inspection of available files (SKILL.md, Workflow step 1) and external documentation or repository evidence fetched through SandBase tools (SKILL.md, SandBase boundary).
- Boundary markers: The instructions do not specify explicit delimiters or warnings for the agent to ignore instructions embedded in the processed data.
- Capability inventory: The skill uses the
sandbase_runtool to execute external capabilities and includes workflow steps to produce implementation artifacts (file writes). - Sanitization: No specific sanitization or filtering of external content is mentioned before it is processed or used in tool arguments.
Audit Metadata