threads-reply-drafter
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of user-pasted Threads post content and conversation history.
- Ingestion points:
SKILL.md(Step 2) instructs the agent to ask the user to paste target post text and relevant conversation context to be used in the drafting process. - Boundary markers: The instructions do not define explicit delimiters or instructions to ignore potential commands embedded within the pasted content before it is processed by the model.
- Capability inventory: The skill utilizes
lib.publish(Step 7) to output generated content, although it notes that many outputs are returned as copy-paste blocks for the user to post manually. - Sanitization: No security-focused sanitization or input validation is performed on the pasted text; the described "Humanizer pass" focuses on stylistic and tonal adjustments rather than injection prevention.
- [DATA_EXFILTRATION]: The skill accesses a configuration file using a relative path that exits the skill's own directory scope.
- Evidence:
SKILL.mdcontains instructions to load and match a user's voice fingerprint from../../references/voice-profile.md. Accessing files outside the skill's root directory via relative paths represents an exposure of user-specific behavioral metadata and personal identity rules.
Audit Metadata