i485-adjustment
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
openniwpackage from PyPI if it is not already available. This package is an external dependency from an unverified source hosted on GitHub that is used for file intake and management.\n- [COMMAND_EXECUTION]: The agent executes various shell commands through theopenniwutility, including starting a local intake server (ui intake) and checking session status. It also performs environment checks fornodeand manages file operations through CLI-based document exports.\n- [PROMPT_INJECTION]: The skill contains defensive instructions to ignore malicious command strings like 'ignore previous instructions' if they appear within user-uploaded documents. While defensive in nature, this acknowledges the risk of the agent following instructions embedded in data.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating an attack surface for indirect prompt injection.\n - Ingestion points: Untrusted data enters the agent context through user-uploaded documents (I-797s, passports, and CVs) that are read and stored in the
sources/directory.\n - Boundary markers: The agent is provided with explicit boundary instructions to treat these files as data and to ignore any embedded commands.\n
- Capability inventory: The skill has the capability to execute shell commands (
openniw), write to the local file system (STATE.md, case.json), and export data to external formats.\n - Sanitization: The skill relies on natural language instructions for the agent to filter data and report any attempted command injection found in processed documents.
Audit Metadata