permissionkit
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation defines patterns for handling untrusted strings within child-to-parent communication flows without providing sanitization or boundary isolation guidance.
- Ingestion points: The
PermissionQuestionconstructor (SKILL.md) andCommunicationTopic.PersonInformation(references/permissionkit-patterns.md) ingest arbitrary strings for message bodies, contact handles, and names. - Boundary markers: The instructions do not recommend or demonstrate the use of delimiters to isolate user-provided content from the system-generated permission request context.
- Capability inventory: The skill leverages the
AskCenter.shared.askmethod to dispatch requests via iMessage, representing a high-privilege communication channel. - Sanitization: No validation, escaping, or filtering logic is provided for external content before it is interpolated into the permission request flow.
Audit Metadata