parts-inventory
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes untrusted data from the local environment, including parts master data, consumption records, and stocking rules (Phase 1). 1. Ingestion points: Project files accessed in Phase 1 (SKILL.md). 2. Boundary markers: None present. 3. Capability inventory: Reads files, writes telemetry to ~/.claude/projects/, and suggests command execution. 4. Sanitization: None present. This creates an attack surface where malicious content in data files could influence agent behavior.
- [PROMPT_INJECTION]: User-supplied $ARGUMENTS are directly interpolated into the prompt logic ('TARGET: $ARGUMENTS'). This lacks sanitization, potentially allowing users to inject override markers (e.g., 'Ignore previous instructions') into the agent's task description.
- [COMMAND_EXECUTION]: The skill suggests the execution of other automated tools as next steps ('/job-dispatch', '/fleet-maintenance'). While these are logical workflow transitions, they represent a capability to chain actions that could be exploited if the initial analysis phase is compromised.
- [DATA_EXPOSURE]: The 'SELF-EVOLUTION TELEMETRY' section involves accessing and appending to files within '~/.claude/projects/'. This perform local file system modifications outside the immediate project workspace to maintain persistent execution logs.
Audit Metadata