workspace-surface-audit
Warn
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to access sensitive file paths, specifically
.envand other environment files (.env*). This is intended to identify service provider names (e.g., Stripe, Twilio) based on key names. Although the instructions explicitly forbid printing secret values, the programmatic access to environment files is a sensitive operation that can lead to data exposure. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection as it ingests untrusted data from multiple repository files.
- Ingestion points:
package.json,README.md,.mcp.json,AGENTS.md,CLAUDE.md, and other repository manifest files. - Boundary markers: The instructions do not define delimiters or specific "ignore embedded instructions" warnings for the content being read.
- Capability inventory: The skill primarily uses file-read capabilities to perform its audit and generate recommendations. It does not explicitly perform network writes or code execution within its own logic.
- Sanitization: No sanitization, escaping, or validation of the external file content is specified before the data is processed by the agent.
Audit Metadata