refine-approach
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted document content provided via
$ARGUMENTSor from local directories without utilizing boundary markers (such as XML tags or triple backticks) or instructions to ignore embedded commands. This creates a risk where a malicious document could influence the agent's behavior during the assessment or modification phases.\n - Ingestion points: Reads file content from paths specified in
$ARGUMENTSor discovered indocs/brainstorm/anddocs/plan/.\n - Boundary markers: Absent; the skill does not wrap processed content in delimiters or provide clear negative constraints to the agent regarding instructions found within the documents.\n
- Capability inventory: The skill possesses the capability to read from the filesystem and perform inline document updates (writing to disk), providing an execution path for injected instructions.\n
- Sanitization: No sanitization, escaping, or validation logic is applied to the document content before it is processed or rewritten.
Audit Metadata