teach-wx
Warn
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads data from external GitHub repositories and source code to generate technical summaries and lessons. This ingestion process lacks explicit boundary markers or sanitization, creating a surface for indirect prompt injection where malicious instructions embedded in a repository could influence the agent's behavior. \n
- Ingestion points: README files, package configuration files, and core source code modules as part of the repository brief (REPO-BRIEF.md) process. \n
- Boundary markers: None identified in the instruction sets or templates. \n
- Capability inventory: Extensive local file writing (MISSION.md, lessons/, etc.) and shell command execution for script verification. \n
- Sanitization: No sanitization or escaping of external content is specified before processing or code generation. \n- [DYNAMIC_EXECUTION]: The instructions in LESSON-CHECKLIST.md direct the agent to 'actually run and record the results' of generated example scripts (Python, Node.js, Shell). Since these scripts are created based on the analysis of untrusted external content, this behavior presents a risk of executing code containing malicious payloads injected from the source material. \n- [COMMAND_EXECUTION]: The skill uses shell commands to manage a complex workspace structure, create numerous files, and execute generated example scripts during the lesson verification phase.
Audit Metadata