xy-loop
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting user-provided thoughts and platform metrics (e.g., likes, views) to determine progression through a content funnel. This creates a vulnerability surface where maliciously crafted user input could attempt to override the agent's logic during decision-making phases.
- Ingestion points: User-provided idea text and manually entered engagement metrics across all关口 (gateways) defined in SKILL.md.
- Boundary markers: The instructions lack explicit delimiters or boundary markers to separate user-provided content from the agent's internal logic.
- Capability inventory: The skill performs file-write operations to a local directory structure (e.g.,
待测/,X已过线/) to store idea status. - Sanitization: There are no instructions for sanitizing or validating user-provided filenames or text before writing to the file system.
- [COMMAND_EXECUTION]: The agent is instructed to manage a local file system hierarchy for content tracking. It writes markdown files (e.g.,
写入 待测/{想法名}.md) based on user-supplied 'idea names'. While these are limited file-system operations, they are directly influenced by user input without specific path validation instructions.
Audit Metadata