tailrocks-agents-md-sync
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including 'repository text', 'audit findings', and 'web content' to drive file system modifications.
- Ingestion points: Ingests audit findings, canonical roots, and raw link targets as defined in
SKILL.md(Sync Step 1) andreferences/runtime-trust.md. - Boundary markers: Explicitly labels repository and audit text as 'untrusted data' and instructs the agent to 'refuse stale, ambiguous, multi-finding, or unapproved work'.
- Capability inventory: Performs file creation, deletion, rule relocation, and symlink manipulation through a dedicated script.
- Sanitization: Requires the model to bind byte/inode preimages and verify content hashes before any mutation occurs.
- [COMMAND_EXECUTION]: The skill instructions define the resolution and execution of a local TypeScript script (
scripts/agents-md-topology.ts) to perform repairs. - Evidence:
SKILL.mdcontains specific instructions to obtain the loader-provided absolute path, resolve the installed topology script, and run the file. - Mitigations: The skill includes strict validation requirements, such as checking
lstatfor every path component, refusing symlinks in the script's path, and ensuring the entrypoint is a regular file.
Audit Metadata