inception
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided requests via the
$ARGUMENTSvariable to generate plans and coordinate specialized sub-skills, creating a surface for potential indirect prompt injection. - Ingestion points: User instructions are captured through the
$ARGUMENTSparameter in theSKILL.mdfile. - Boundary markers: The skill enforces a structured plan format (detailed in
references/depth-bar.md) and maintains an internalINCEPTION_STATEto track execution flow, which helps differentiate instructions from data. - Capability inventory: The skill is capable of writing to and editing files within specific host-native plan directories (e.g.,
~/.cursor/plans/,~/.claude/plans/) and can initiate theexecuteskill when explicitly requested by the user via the--autopilotflag. - Sanitization: The skill's 'Operating contract' and 'Forbidden' ruleset in
references/hosts.mdexplicitly prohibit unauthorized modifications to critical system or configuration files, such as.balakit/installed.json.
Audit Metadata