meta-multi-format-export-pack
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and chains multiple content-processing and file-generation tools, providing a pathway for malicious instructions embedded in user data to influence downstream actions.
- Ingestion points: Untrusted data is ingested through the inputs.user_message variable in SKILL.md.
- Boundary markers: The skill lacks explicit delimiters (e.g., XML tags or triple quotes) or system instructions to the agent to treat the user content purely as data, which may allow instructions embedded in the source text to be obeyed during the summarize or xlsx tasks.
- Capability inventory: The skill invokes high-privilege document creation capabilities, including the docx, pptx, xlsx, and html-to-pdf skills.
- Sanitization: Although xml_escape is applied to the HTML/PDF output, it is absent from the interpolations for the docx (body), pptx (outline), and xlsx (task) steps, leaving those specific tool invocations susceptible to instruction overrides via untrusted data.
Audit Metadata