utk
Warn
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill implements a plugin architecture that loads configuration and logic from workspace-local paths ('.utk/plugins/serialization' and '.utk/packs/').
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to mediate tool outputs ('tool_output', 'toolOutput', 'result'), which are external inputs that could contain malicious instructions.
- Evidence Chain for Indirect Injection:
- Ingestion points: 'references/copilot-hooks.md' identifies 'tool_output', 'toolOutput', and 'result' as observable payloads from the Copilot hook.
- Boundary markers: The documentation does not specify any delimiters or instructions for the agent to ignore embedded commands within the observed tool outputs.
- Capability inventory: The skill has access to read and write files within the workspace ('.utk/' directory) and can modify the output returned to the user's chat context.
- Sanitization: No sanitization, escaping, or validation logic is described for the tool outputs before they are processed by the mediation pipeline.
Audit Metadata