ln-100-documents-pipeline
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from legacy documentation files.\n
- Ingestion points:
Phase 0.1(Legacy Detection) andPhase 4.1(Duplicate Scan) read existing project files such asREADME.md,ARCHITECTURE.md, anddocumentation/**/*.mdusing theGlobandReadtools.\n - Boundary markers: There are no explicit markers or instructions provided to the agent to disregard embedded commands or instructions within the legacy content during extraction or injection.\n
- Capability inventory: The skill utilizes the
Skilltool for sub-skill invocation, theEdittool for writing/modifying files, and theDeletetool for removing files.\n - Sanitization: The skill lacks sanitization or validation of the extracted content before it is merged into the
contextStoreor written to new documentation files.\n- [COMMAND_EXECUTION]: The orchestrator performs high-privilege file system operations and automated tool invocations.\n - File Deletion:
Phase 0.6explicitly instructs the agent to delete standalone legacy files (e.g.,ARCHITECTURE.md) after they are migrated to the new structure.\n - Automated Skill Invocation:
Phase 2uses theSkilltool to automatically trigger a sequence of five other skills (ln-110toln-150) without individual per-step user approval after the initial confirmation.\n - Mass File Modification:
Phase 3(Global Cleanup) uses theEdittool to modify all discovered.mdfiles in thedocs/directory to remove duplicates and fix links.\n- [DATA_EXFILTRATION]: The skill exposes sensitive architectural and configuration data to the agent context.\n - Metadata Extraction: The
references/legacy_detection_patterns.mdfile defines patterns to scan for and extract details about API endpoints, authentication methods, database schemas, infrastructure specs (IPs, hostnames), and environment variables (env_vars). While this is intended for documentation, it brings sensitive system metadata into the LLM processing environment.
Audit Metadata