do-in-steps
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the user-provided task and outputs from various sub-agents, creating a surface for potential injection.\n
- Ingestion points: The free-form
taskargument in SKILL.md and the results returned by implementation, meta-judge, and judge agents.\n - Boundary markers: The skill utilizes XML-style tags (such as
<task>,<subtask_context>, and<previous_steps_context>) to separate untrusted data from instructions.\n - Capability inventory: Implementation sub-agents are granted broad tool permissions for file modifications and shell execution, creating a path for malicious instructions to trigger actions.\n
- Sanitization: The instructions mandate stripping flags from task input, but no semantic filtering or validation of the task body itself is present.\n- [COMMAND_EXECUTION]: The skill performs basic environment initialization via shell commands.\n
- Evidence: Executes
mkdir -p .specs/reportsduring the setup phase to establish the reporting directory.
Audit Metadata