outline-expand

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text from outline files (.md, .tex, .txt) and interpolates it directly into task briefs for the @paper-writer subagent. This presents a vulnerability surface where instructions embedded within the outline could manipulate the subagent's behavior.\n
  • Ingestion points: Outline content is parsed and stored in the section_plan during phases/01-precheck.md (Step 4).\n
  • Boundary markers: The content is presented to subagents with a simple textual header in phases/02-map.md (Step 3) but lacks robust delimiters or explicit instructions to disregard embedded commands.\n
  • Capability inventory: The skill has the capability to write to the local filesystem using the Write tool and create directories via shell commands as detailed in phases/03-reduce.md (Steps 1b, 1c).\n
  • Sanitization: No validation, escaping, or filtering of the outline text is performed prior to prompt interpolation.\n- [COMMAND_EXECUTION]: The skill executes directory creation commands (mkdir -p) to ensure manuscript and section paths exist. This is part of the intended functionality but involves direct interaction with the host filesystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 09:21 AM
Security Audit — agent-trust-hub — outline-expand