no-black-box
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use local system utilities such as the macOS
qlmanagetool to render previews of documents (xlsx,docx) provided by the user. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and summarize untrusted external documents, which presents a risk of indirect prompt injection.
- Ingestion points: Processes user-supplied materials including requirement documents, notes, and spreadsheets as described in
SKILL.md. - Boundary markers: Encourages the use of strict "Original Text" (原文) vs "Interpretation" (解读) structures and provides HTML templates to separate external content from agent reasoning.
- Capability inventory: Instructs the agent to execute shell commands for document rendering and to use headless browsers for screenshot capture (
references/evidence.md). - Sanitization: Includes explicit instructions for data de-sensitization and the removal of hardcoded credentials or private identifiers in Section 6 of
SKILL.md. - [DYNAMIC_EXECUTION]: The workflow includes dynamically rendering documents to HTML and using automated browser tools to capture screenshots of the results.
Audit Metadata