outline-expand
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text from outline files (.md, .tex, .txt) and interpolates it directly into task briefs for the @paper-writer subagent. This presents a vulnerability surface where instructions embedded within the outline could manipulate the subagent's behavior.\n
- Ingestion points: Outline content is parsed and stored in the section_plan during phases/01-precheck.md (Step 4).\n
- Boundary markers: The content is presented to subagents with a simple textual header in phases/02-map.md (Step 3) but lacks robust delimiters or explicit instructions to disregard embedded commands.\n
- Capability inventory: The skill has the capability to write to the local filesystem using the Write tool and create directories via shell commands as detailed in phases/03-reduce.md (Steps 1b, 1c).\n
- Sanitization: No validation, escaping, or filtering of the outline text is performed prior to prompt interpolation.\n- [COMMAND_EXECUTION]: The skill executes directory creation commands (mkdir -p) to ensure manuscript and section paths exist. This is part of the intended functionality but involves direct interaction with the host filesystem.
Audit Metadata