show-me-your-work
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash script
scripts/log.shthat performs basic file operations (mkdir, printf) and usesdateto generate timestamps. These are standard operations for the skill's logging purpose. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and log descriptions of decisions ('why', 'decision', 'result'). If these fields are populated from untrusted external data without sanitization, it creates a surface for indirect prompt injection, although the current implementation uses a helper script that performs basic character cleaning.
Audit Metadata