skill-post-scorer
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, including social media post drafts and historical performance data (JSON/CSV). Malicious instructions could be embedded within these inputs to manipulate the scoring outcome or influence the agent's behavior during the feature extraction and rewrite phases.
- Ingestion points: Untrusted content is ingested via user prompts (post text) and external files (historical data paths specified in the account profile or provided by the user) as described in
SKILL.md. - Boundary markers: The instructions do not define clear boundary markers or instructions for the AI to ignore embedded commands within the analyzed posts.
- Capability inventory: The skill can execute shell commands (
python3 scripts/score.py) and read files from the local filesystem (outputs/directory and profile-specified paths). - Sanitization: While
scripts/score.pyperforms deterministic JSON parsing, the subsequent LLM analysis of "Top posts" for feature extraction does not include sanitization of the text content. - [COMMAND_EXECUTION]: The skill instructions in
SKILL.mdexplicitly direct the agent to execute a local Python script (scripts/score.py) usingpython3. This script handles the statistical analysis of engagement data to avoid "hallucination" in math, but it represents a shell execution surface within the skill's workflow.
Audit Metadata