vp-foreign-agent-skill-loader
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to discover and index instruction files (SKILL.md) from hidden agent-specific directories (e.g.,
.<agent>/skills/) within the local repository. This functionality exposes the agent to a surface for indirect prompt injection, as it is explicitly instructed to 'read the selected instruction completely before acting,' which may lead to the execution of untrusted or malicious logic contained in those foreign files. - Ingestion points: The
scripts/index-foreign-agent-skills.mjsscript performs automated scanning and parsing ofSKILL.mdfiles found in hidden directories throughout the repository root. - Boundary markers: Although the skill instructions include a warning to treat content as untrusted, no technical boundary markers or data sanitization are applied to the foreign instructions before they are presented to the agent.
- Capability inventory: The skill utilizes standard Node.js filesystem modules (
fs.readdirSync,fs.readFileSync) to crawl directories and extract skill metadata. - Sanitization: The discovery process extracts and formats metadata into Markdown/JSON for the agent but does not filter or sanitize the actual instructional content of the files being indexed.
Audit Metadata