outline-refiner
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from multiple user-modifiable files within the workspace and includes this data in its generated reports. Without proper sanitization or boundary markers, malicious instructions placed in these input files could potentially influence the agent's behavior when it reads the generated coverage reports.\n
- Ingestion points: Reads from
outline/outline.yml,outline/mapping.tsv,papers/paper_notes.jsonl,outline/subsection_briefs.jsonl,GOAL.md,outline/section_binding_report.md, andDECISIONS.mdas seen inscripts/run.py.\n - Boundary markers: The Markdown report generation logic does not utilize delimiters or warnings to isolate external data from instructions.\n
- Capability inventory: The skill is restricted to file system operations (read/write) within the specified workspace. It lacks network access, shell command execution of untrusted data, or high-privilege capabilities.\n
- Sanitization: JSON outputs are correctly escaped using standard serialization, but the Markdown report interpolates raw text from input files without escaping.\n- [SAFE]: The skill's behavior is consistent with its stated purpose of outline refinement. It operates locally on project files, uses standard libraries, and does not exhibit patterns associated with credential theft, persistence, or remote code execution. The use of internal project modules and the
uvtool for execution is typical for this environment.
Audit Metadata