subsystem-walkthrough
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses templates that ingest external, potentially untrusted content, creating a surface for indirect prompt injection attacks.\n
- Ingestion points: External data enters the context through the
{QUESTION}and{EXPLORER_FINDINGS_ALL}placeholders withinreferences/explainer-prompt.mdandreferences/explorer-prompt.md.\n - Boundary markers: The templates use Markdown structure such as headers and blockquotes (e.g.,
> {QUESTION}) as delimiters, but do not provide explicit instructions for the agent to ignore instructions embedded within these data segments.\n - Capability inventory: The skill instructions consistently emphasize a "Read-only" approach for exploration and synthesis, which reduces the risk of malicious actions (like file modification or network exfiltration) being executed if an injection occurs.\n
- Sanitization: There is no indication of active sanitization, validation, or escaping applied to the content interpolated into the prompt templates.\n- [NO_CODE]: The skill is composed entirely of Markdown documentation and prompt templates. It does not contain any executable scripts, binaries, or automated setup routines.
Audit Metadata