work-draft-reply
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from pull request reviews and issue comments, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads PR review comments, issue bodies, and comments via tools like
df-tpranddf-ti. - Boundary markers: The instructions do not define delimiters or provide specific directions to the agent to ignore instructions that might be embedded in the ingested thread content.
- Capability inventory: The skill has the ability to read local files (
~/.agents/skills/unslop/SKILL.md), write to the project'stmp/directory, and generate CLI commands (gt) for the user to execute. - Sanitization: While the skill includes instructions to wrap HTML tags in backticks for Forgejo, it lacks general sanitization or escaping mechanisms for the untrusted external text.
- [DATA_EXFILTRATION]: The skill requires the agent to access a specific file in the user's home directory (
~/.agents/skills/unslop/SKILL.md) to apply formatting rules. While likely benign, referencing absolute paths in the home directory is a pattern that can be leveraged for unauthorized data exposure.
Audit Metadata