handbook-paper-writer
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest and process external data that may be provided by untrusted third parties, specifically during the revision and maintenance phase (Phase 6).
- Ingestion points: Untrusted content enters the agent's context through 'reader feedback' and 'official platform update logs' which trigger the revision workflow, as well as initial user briefings.
- Boundary markers: The project state is managed using a structured blackboard system (book_state.json), but the instructions do not specify explicit text delimiters (such as XML tags or unique separators) to isolate ingested raw text within prompt templates.
- Capability inventory: The skill possesses the capability to invoke 14 specialized sub-skills and maintain persistence by writing files to the local workspace's .handbook/ directory.
- Sanitization: content is validated through a series of dedicated 'gate' skills (e.g., handbook-gate-fact, handbook-gate-plain) that check generated content against a technical 'kernel skills' dictionary to ensure accuracy and prevent instructions from being obeyed at runtime.
Audit Metadata