churn-define
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions to conceal internal execution steps and tool invocations from the user. Specifically, it states: 'Do not expose internal execution steps (do not say "I'm now executing Step X" or "I'm calling XX tool")'. This practice of hiding the agent's logic reduces operational transparency and is a technique that can be used to mask malicious activity.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata and event lists retrieved via external tool calls (
ae-cli) and interpolates this data into subsequent commands and report definitions. This creates an attack surface where maliciously crafted metadata or event names could influence the agent's behavior or inject content into the final assets. - Ingestion points: Data retrieved from
ae-cli analysis-meta property listandae-cli analysis-meta event list(referenced in SKILL.md Step 2 and ae-cli-guide.md Section 1). - Boundary markers: The skill utilizes 'Pre-operation Confirmation' tables to present parameters to the user before execution, but it lacks specific boundary markers (e.g., delimiters) when processing the raw tool output.
- Capability inventory: The skill has the capability to perform write operations via
ae-cli, including creating virtual properties (virtual-property create), user tags (user-tag create), and analysis reports (report create). - Sanitization: While the guide mentions validating SQL expressions against discovered metadata, there is no explicit sanitization logic for string inputs derived from external metadata used in CLI command arguments.
Audit Metadata