scrolls-setup
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local data to populate project documentation templates, creating an attack surface for indirect prompt injection.\n
- Ingestion points: The agent is instructed to read local project manifest files, including
package.json,pyproject.toml, andCargo.toml, as well as the repository's rootREADME.mdand existingSTARTER.mdfiles (Steps 1 and 2).\n - Boundary markers: The instructions do not define delimiters or provide guidance for the agent to treat data from these manifest files as untrusted content.\n
- Capability inventory: The skill utilizes file system tools (Read, Write, Edit) and executes the
gitCLI for repository path discovery.\n - Sanitization: No sanitization or validation logic is specified for the strings extracted from project manifests before they are interpolated into the generated markdown templates.
Audit Metadata