signal-state
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill establishes an indirect prompt injection vector by ingesting state data from a persistent local file.
- Ingestion points: The file
.signal_state.mdis read at session start and during updates to establish the agent's operational context (referenced inSKILL.mdandSKILL.min.md). - Boundary markers: The system uses structured Markdown and YAML but lacks explicit boundary markers or security instructions to prevent the agent from obeying commands embedded within the state file.
- Capability inventory: The skill is designed to use file-system tools (
write_file,replace) to maintain the state file; no high-risk capabilities like network access or subprocess execution were detected. - Sanitization: No automated sanitization or schema validation is implemented for the data read from the state file.
Audit Metadata