aegis-html-ledger
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill aggregates project state, chat history, and work progress into a persistent HTML ledger that is intended to be read by replacement agents. This creates a vulnerability where malicious content within the project or chat context could be recorded into the ledger and automatically processed by a subsequent agent.
- Ingestion points: Active project files, chat context, and artifact references (SKILL.md).
- Boundary markers: There are no instructions for using delimiters, escaping, or "ignore instructions" warnings when populating the HTML ledger.
- Capability inventory: Filesystem write access to project directories, iCloud storage, and temporary folders; integration with downstream handoff tools.
- Sanitization: No data sanitization, filtering, or validation is performed on the content before it is committed to the durable record.
- [DATA_EXFILTRATION]: The instructions require the agent to maintain copies of the project ledger in the "operator's iCloud location" and the "OS temporary directory".
- Moving execution state and project artifact references to locations outside the controlled project directory (such as a cloud-synced iCloud folder or a shared system temporary directory) may result in sensitive data exposure depending on the host environment's security posture.
Audit Metadata