writing-fragments
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads existing markdown files from the local disk, which constitutes an ingestion point for untrusted data if the file is modified by other processes or users.
- Ingestion points: The skill instructions specify that it must re-read the file from disk before every write to preserve user changes (SKILL.md).
- Boundary markers: While fragments are separated by horizontal rules (---), there are no instructions to the agent to treat the content as data only or to ignore embedded instructions.
- Capability inventory: The skill possesses file system write and append capabilities but has model invocation disabled in its frontmatter.
- Sanitization: The skill performs no validation or sanitization of the file content before it is read into the agent's context.
- [NO_CODE]: The skill consists entirely of natural language instructions and configuration files; it does not include any scripts, binaries, or dependencies.
Audit Metadata