mdpr-skill
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run local commands via
node bin/mdpr-skill.jsto perform specialized presentation review tasks. These operations are restricted to the local workspace and are consistent with the skill's stated purpose of enhancing the MDPR tool workflow. - [PROMPT_INJECTION]: The skill is designed to ingest and analyze user-controlled files like Markdown decks and manifest JSONs, creating a surface for indirect prompt injection.
- Ingestion points: Files like
deck.md,dist/mdpresent-manifest.json, andtemplate-layout-catalog.jsonare read from the local workspace. - Boundary markers: There are no explicit instructions for the agent to use boundary markers or delimiters when processing these external files to prevent instruction leakage.
- Capability inventory: The skill enables the agent to execute local shell commands through Node.js scripts based on the analysis of these files.
- Sanitization: No sanitization or validation routines for the external file content are described within the skill instructions.
Audit Metadata