vague
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE] (SAFE): The skill writes session state to .claude/clarify-vague.local.md. This is standard behavior for maintaining context and does not involve sensitive file access or network exfiltration.
- [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes untrusted user requirements without sanitization. 1. Ingestion points: [REQUIREMENT] variable used in file creation and output blocks. 2. Boundary markers: Absent. 3. Capability inventory: Limited to local file writing and structured user interaction via AskUserQuestion. 4. Sanitization: None detected. The risk is low due to the constrained nature of the clarification protocol.
Audit Metadata