okr-writer
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, which creates a surface for indirect prompt injection. Malicious instructions could be embedded in the files it reads or the context it retrieves.
- Ingestion points: The skill reads existing OKR files from paths like
strategy/,okrs/, andplanning/. It also ingests data via platform commands like/context-recalland/feedback-recall. - Boundary markers: The instructions do not define clear delimiters or "ignore instructions" warnings when processing the content of these external files.
- Capability inventory: The skill has the ability to read from and write to the filesystem (saving OKRs in project folders) and execute various platform-specific commands (
/context-recall,/context-save,/present). - Sanitization: There is no evidence of content sanitization or validation to prevent embedded instructions in OKR documents from influencing agent behavior.
Audit Metadata