dot-ai-query-dot-ai
Warn
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: MEDIUMDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill explicitly instructs the agent to traverse the file system to sibling directories (
../) to access multiple other projects (dot-ai,dot-ai-ui,dot-ai-controller, etc.). This expands the agent's access scope beyond the immediate project environment. - [DATA_EXFILTRATION]: The skill identifies
dot-ai-infraas containing "Production infrastructure" and permits the agent to query it upon user request. Accessing infrastructure code significantly increases the risk of exposing sensitive deployment configurations or secrets. - [DATA_EXFILTRATION]: The instructions encourage tracing code paths from "definition → implementation → exposure," which involves deep recursive reading of files across multiple projects, increasing the likelihood of encountering and potentially leaking sensitive internal implementation details.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to ingest and process untrusted data from external codebases.
- Ingestion points: Reads files from sibling project directories (
../dot-ai,../dot-ai-ui, etc.) using Grep, Read, and Glob tools. - Boundary markers: Absent. No instructions are provided to the agent to ignore or delimit instructions found within the code comments or documentation of the queried projects.
- Capability inventory: The agent has full access to file system tools (Read, Grep, Glob) and has no restrictions on tool usage in the YAML frontmatter.
- Sanitization: Absent. There is no validation or filtering mentioned for the content retrieved from the external projects.
Audit Metadata