agent-config-tidy
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (agent configurations and script comments) and attempts to interpret and rewrite it. This creates a surface for indirect prompt injection if the files being scanned contain malicious instructions designed to subvert the agent's cleanup logic.
- Ingestion points: Files identified during directory scanning, including
AGENTS.md,soul.md,SKILL.md, YAML configuration files, and various script formats (.py,.sh,.js, etc.). - Boundary markers: The skill does not define strict delimiters for the data it processes, relying instead on its internal classification rules to distinguish between 'runtime instructions' and 'background information'.
- Capability inventory: The skill utilizes directory traversal, file reading, and file writing (including modification of executable scripts).
- Sanitization: The skill implements a 'diff report' workflow and requires explicit user confirmation before any modifications are applied, which acts as a human-in-the-loop validation step.
- [COMMAND_EXECUTION]: The skill performs recursive directory scanning and modifies various executable script formats (.py, .sh, .ps1, .js, .ts, .bash). While the instructions specify that it should only modify comments and status outputs without touching code logic, the capability to write to executable files is a sensitive operation.
Audit Metadata