social-sandbox
Warn
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python recipe provided in the skill dynamically modifies the system path to load local modules from a directory in the user's home folder (
~/.claude/skills/persona-sim). This pattern allows the execution of code from outside the immediate skill directory and relies on the security of the target directory. - [PROMPT_INJECTION]: The skill processes a "scenario" variable by directly interpolating it into a task string for LLM-simulated personas. This creates an indirect prompt injection surface where instructions embedded in the scenario could influence or override the intended simulation behavior.
- Ingestion points: The
scenariovariable defined in the Python script inSKILL.md. - Boundary markers: None identified; the scenario is directly concatenated into the prompt string.
- Capability inventory: The script uses a custom
generatefunction and has the ability to load external library files via path manipulation. - Sanitization: No validation or escaping is applied to the scenario text before it is used in the prompt.
Audit Metadata