shiny-aiconversation
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the
ChatLookupAITool, which enables the AI to search and retrieve past conversation history from theIMessageStore. This creates a potential surface where malicious instructions stored in previous chat messages could influence the agent's behavior when retrieved in a subsequent turn. - Ingestion points: The
ChatLookupAITool(documented inchat-lookup-tool.md) retrieves historical chat data from theIMessageStore(message-store.md) and injects it into the AI's context. - Boundary markers: The documentation does not specify the use of delimiters or explicit instructions for the AI to ignore potentially malicious content within the retrieved history.
- Capability inventory: The library provides several AI-controllable capabilities, such as
change_voice,play_voice_sample, andget_available_voices(documented invoice-selection-tools.md), which could be targeted by an injection attack. - Sanitization: There is no mention of sanitization or filtering of historical messages before they are processed by the AI tool.
Audit Metadata