note-refine
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Yuque documents or user-pasted text which could contain malicious instructions.
- Ingestion points: Source content is retrieved via the yuque_get_doc tool or direct user input as described in Step 1 (SKILL.md).
- Boundary markers: The instructions lack explicit boundary markers (such as XML tags or specific delimiters) to isolate the ingested document content from the agent's internal instructions, although they do emphasize preserving original meaning.
- Capability inventory: The skill utilizes the yuque_update_doc tool (SKILL.md), providing a write capability to the knowledge base which could be misused if an injection is successful.
- Sanitization: There is no mention of sanitization, filtering, or specific validation of the document content before it is processed by the model.
Audit Metadata