doc-coauthoring
Safety Score
Detected Capabilities
Sensitive Files
- Clean filesystem scan
Deep Audit Findings
This skill defines a 'Doc Co-Authoring' workflow that orchestrates a multi-stage process involving sensitive context gathering, file system manipulation (create/edit), and recursive agent invocation ('sub-agents'). While designed for productivity, it explicitly solicits highly sensitive organizational data (politics, incidents) and instructs the agent to spawn sub-processes/sub-agents, creating risks around data privacy and uncontrolled execution loops if the underlying runtime (e.g., Claude Code) grants full permission to sub-agents.
Unconstrained Sub-Agent Invocation
The workflow explicitly instructs the runtime to 'invoke a sub-agent' during the Reader Testing stage. Without strict sandboxing, sub-agents can inherit parent permissions, potentially bypassing restrictions, consuming excessive resources, or executing code in a new context without user oversight.
Solicitation of Sensitive Organizational Data
The prompt explicitly asks the user to dump 'politics', 'team dynamics', and 'past incidents'. This encourages the user to introduce highly sensitive Non-Public Information (NPI) into the LLM context, which may be logged or leaked if the 'Reader Testing' phase sends this data to external endpoints.
Direct File System Modification
The skill uses `create_file` and `str_replace` to modify documents. While intended for drafting, automated file editing based on broad context can lead to accidental data loss or overwriting of wrong files if the agent hallucinates filenames.
Attack Surface Chain
Attacker (or user) provides malicious instructions mixed with legitimate context during the 'Info Dumping' stage (Stage 1).
The agent incorporates the malicious instructions into the 'draft' document during Stage 2.
During Stage 3 ('Reader Testing'), the agent 'invokes a sub-agent' passing the drafted document.
The sub-agent executes the malicious instructions contained in the draft (Prompt Injection), potentially utilizing the 'shell' capability identified in static findings to exfiltrate data or modify the system.