yzr-writing-review
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary user-provided text, documents, and file paths, which serves as an entry point for indirect prompt injection attacks where malicious instructions could be embedded in the content being reviewed.
- Ingestion points: Text fragments, file paths, and directory contents provided by the user (SKILL.md, Step 1).
- Boundary markers: The skill incorporates a "Understanding Paraphrase" step (Step 5.1) where the agent restates its understanding of the text, providing a manual check against unintended instruction following, though it lacks formal automated delimiters or sanitization headers.
- Capability inventory: The skill has the ability to read local files and perform in-place file modifications ("就地编辑") upon user confirmation (SKILL.md, "改写承接").
- Sanitization: There is no mention of sanitizing or escaping the input text before processing, which could allow specifically crafted content to manipulate the agent's output or file-writing operations.
Audit Metadata