xy-casefile
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages a knowledge engineering system where it reads from and writes to local Markdown files (stored in
~/.xy/decisions/) based on user input. This creates an indirect prompt injection surface where malicious instructions could be embedded in the decision logs or facts, potentially influencing the agent's behavior when these files are re-read in future sessions. - [INDIRECT_PROMPT_INJECTION]: The skill explicitly creates an
AGENTS.mdfile containing "hardline instructions" intended for any AI agent that accesses the directory (e.g., Claude Code). This functions as a persistence mechanism for instructions that could override default agent behavior within the scope of the project files. - Ingestion points: Processes user-provided business details and reads existing Markdown project files.
- Boundary markers: Uses specific metadata tags like
[本人](User) and[AI 推测](AI Inference) to distinguish sources, though it lacks strict data/instruction delimiters. - Capability inventory: Performs local file system read and write operations.
- Sanitization: Implements a 'privacy mode' that replaces real names with aliases, but does not explicitly sanitize natural language content for command or prompt injection patterns.
Audit Metadata