sumeru-write
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files such as
.sumeru/outline/chapter-outlines.json,characters.json, andworld.jsonto drive content generation. - Ingestion points: The skill reads multiple JSON files from the
.sumeru/outline/directory to fetch plot details, character definitions, and world settings. - Boundary markers: There are no explicit instructions or delimiters mentioned to ensure the agent ignores potential natural language instructions embedded within these data files.
- Capability inventory: The skill has the capability to write multiple files to the
chapters/directory and internal metadata to the.sumeru/write/directory, which could be exploited if an injection occurs. - Sanitization: While the skill mentions validating field presence and cross-referencing names, it lacks sanitization of the actual content to prevent plot descriptions from acting as secondary prompts that could override the agent's behavior or safety constraints.
Audit Metadata