helm-recon
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the
Bashtool to find and list markdown files and search for specific product-related keywords. The commands inSKILL.mdare static and limited to environment reconnaissance. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes the content of untrusted local markdown files found during the discovery phase. An attacker could embed malicious instructions within these documents.
- Ingestion points: Local markdown files (
*.md) in various project directories likedocs/,research/, andbriefs/. - Boundary markers: The instructions do not specify any delimiters or safety warnings to distinguish between file content and agent instructions.
- Capability inventory: The skill is allowed to use
Bash,WebFetch,WebSearch, andReadtools. - Sanitization: There is no evidence of sanitization or filtering of the content retrieved from external files before it is processed by the agent.
Audit Metadata