workspace-surface-audit
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions direct the agent to access sensitive file paths such as
.envfiles,.mcp.json, and.claude/settings*.jsonto identify available services and configurations. Although there is an explicit rule to 'Never print secret values,' the inherent access to these sensitive paths creates a risk of data exposure if the agent's context is compromised or if instructions are bypassed. - Evidence: SKILL.md lists
.env*files,.mcp.json, and.claude/settings*.jsonunder the 'Audit Inputs' section. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository to perform its audit, which serves as an attack surface for indirect prompt injection.
- Ingestion points: The skill reads
package.json,README.md,CLAUDE.md, and various framework/install manifests. - Boundary markers: There are no explicit instructions to use delimiters or to disregard instructions found within the audited files.
- Capability inventory: The skill relies on filesystem read tools to gather data.
- Sanitization: The instructions do not specify any validation, escaping, or filtering for the content ingested from the workspace files.
Audit Metadata