shaping
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill methodology requires the agent to ingest and store untrusted user data (such as source material, emails, and requirements) verbatim, which creates a surface for indirect prompt injection attacks.
- Ingestion points: External content provided by the user is captured in the Frame document (under a Source section) and requirements are documented in the Shaping doc as described in SKILL.md.
- Boundary markers: The skill instructions mention placing source material in a specific Source section, which acts as a basic delimiter, though the methodology emphasizes verbatim capture without specific instruction-bypass warnings.
- Capability inventory: The skill and its associated script (shaping-ripple.sh) are restricted to reading and writing markdown files and performing consistency checks; no network exfiltration or arbitrary code execution capabilities are present in the provided files.
- Sanitization: No sanitization, escaping, or filtering of the user-provided source content is performed before it is included in the agent's context.
Audit Metadata