research
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow that involves ingesting and processing untrusted external data sources, including codebase surveys, CI logs, and large diffs or pull requests. This workflow creates a surface for indirect prompt injection attacks where malicious instructions hidden in these sources could potentially influence the subagent's distilled output or the orchestrator's subsequent actions.
- Ingestion points: External data sources like files, logs, and diffs as specified in SKILL.md.
- Boundary markers: The instructions do not prescribe the use of delimiters or 'ignore embedded instructions' prompts when passing data to subagents.
- Capability inventory: Utilization of subagent spawning with specific model tiers for search and distillation tasks.
- Sanitization: No mention of sanitizing or escaping the external content before it is processed by the agent system.
Audit Metadata