proving-change-safety
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructions explicitly direct the agent to generate and run executable code. Step 5 of the process requires the agent to "Prove the one fact by calling the real function (script or test)" and to "Leave the prove script in the tree." This involves runtime script generation and execution to verify the behavior of the system under review.
- [COMMAND_EXECUTION]: To satisfy the "Prove" requirement, the agent must invoke shell commands to run the generated scripts or tests within the local environment.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data in the form of code changes or diffs. This creates a surface for indirect prompt injection where malicious instructions embedded in code comments or metadata could influence the agent's behavior during the script generation and execution phase.
- Ingestion points: The skill reads external code changes, symbols, and diffs (referenced in Step 1: "Read the change").
- Boundary markers: There are no explicit instructions or delimiters defined to isolate the untrusted diff content from the agent's core instructions.
- Capability inventory: The agent has the capability to write files to the directory and execute them via the shell (Step 5).
- Sanitization: No sanitization or validation logic is specified for the code or symbols ingested before they are used to generate the "prove" script.
Audit Metadata