image-storage-optimization
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external codebase data while possessing the capability to modify source code. Maliciously crafted comments or code within a scanned repository could influence the agent's behavior during the implementation phase.
- Ingestion points: The agent scans the entire project codebase or specific target paths for image handling logic (SKILL.md).
- Boundary markers: None present; the skill lacks delimiters or specific instructions to ignore embedded instructions within the scanned source files.
- Capability inventory: The skill includes instructions to implement code changes (Phase 3) and run verification tools like /qa or /e2e.
- Sanitization: None; the skill does not specify validation or sanitization steps for the code it parses before acting upon it.
- [DATA_EXFILTRATION]: When no target argument is provided, the skill is instructed to scan the entire codebase. This broad read access exposes the agent to all project files, including sensitive configurations. Additionally, the skill appends execution metadata to a local telemetry file at
~/.claude/projects/skill-telemetry.md, creating a persistent record of agent activity on the system. - [COMMAND_EXECUTION]: The skill is designed to automatically modify source code and execute verification commands. The instruction 'Do NOT ask the user questions' combined with the 'SELF-HEALING VALIDATION' loop removes the human-in-the-loop for high-privilege file system modifications and tool executions.
Audit Metadata