warehouse-ops
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It instructs the agent to ingest and analyze untrusted data from the local codebase (package manifests, data models, inventory records) without using boundary markers or sanitization logic. Maliciously crafted content within these files could influence agent behavior during the analysis phase.
- Ingestion points: Project codebase files, package manifests, and WMS data structures.
- Boundary markers: Absent; no delimiters are used to wrap external content.
- Capability inventory: File system read access, file system write access (to
docs/and~/.claude/), and directory creation. - Sanitization: Absent; the skill does not specify filtering or escaping of ingested data.
- [DATA_EXFILTRATION]: The skill includes a 'Self-Evolution Telemetry' mechanism that identifies and writes to hidden directories in the user's home folder (
~/.claude/projects/). While the data logged is metadata about skill execution, this represents an undocumented write operation to a sensitive configuration path that persists across sessions.
Audit Metadata