sumeru-review
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text content from novel chapters and possesses file-writing capabilities, exposing an indirect prompt injection surface.\n
- Ingestion points: Reads arbitrary novel content from the
chapters/directory and outline guidelines from.sumeru/outline/chapter-outlines.jsonas specified inSKILL.md.\n - Boundary markers: Absent. The instructions do not prescribe specific delimiters or isolation techniques to differentiate between story content and operational commands.\n
- Capability inventory: Contains file-system modification capabilities, allowing the agent to overwrite text in the
chapters/directory and update JSON structures inside the.sumeru/workspace.\n - Sanitization: Absent. There is no predefined mechanism to sanitize or escape user-provided narrative text before processing or using it to drive sub-agent activities.
Audit Metadata