teach
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the files it processes within the workspace.
- Ingestion points: The agent reads content from
MISSION.md,GLOSSARY.md,RESOURCES.md, and various files in the./learning-records/directory. - Boundary markers: There are no instructions defining explicit boundaries or delimiters to treat the content of these files as untrusted data rather than instructions.
- Capability inventory: The skill is capable of writing files to the local system (
.html,.md) and suggesting CLI commands for the user to execute. - Sanitization: The instructions do not specify any validation or sanitization for the content ingested from the workspace files.
- [COMMAND_EXECUTION]: The skill instructions explicitly encourage the agent to generate and provide CLI commands to the user.
- Evidence: In
SKILL.md, it states: "You should make opening the HTML explainer as easy as possible for the user, ideally with a CLI command they can run." This establishes a pattern of the agent generating executable strings for the user's terminal, which could be exploited if the inputs used to generate the HTML or command are malicious.
Audit Metadata