fall-risk
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it ingests untrusted data from the codebase and configuration files without safety boundaries.\n
- Ingestion points: The skill reads configuration files, dependency manifests, environment definitions, and the entire local codebase (Phase 1).\n
- Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands in analyzed data.\n
- Capability inventory: The skill possesses file system read/write capabilities (telemetry logging) and the ability to scan environment variables.\n
- Sanitization: Absent; data from external files is processed directly into the agent context without escaping or validation.\n- [DATA_EXFILTRATION]: The skill implements a persistence mechanism that writes execution metadata to
~/.claude/projects/skill-telemetry.md. This involves accessing and writing to a path outside the immediate project directory to track and store execution history.\n- [CREDENTIALS_UNSAFE]: The skill is instructed to investigate environment definitions and configuration files to map the technology stack. This pattern risks exposing sensitive hardcoded credentials or API keys if they are present in the project's environment configuration.
Audit Metadata