agentsop-per-model-artifacts
Warn
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes Python's pickling mechanism and dynamic module imports to manage and test prompt artifacts at runtime.
- Evidence: The R1-source-evidence.md file explicitly states that 'save_program=True' pickles the module graph and state for portability.
- Evidence: The Recipe 2 (swap_test.py) in R2-versioning-recipes.md demonstrates dynamic module loading via an 'import_program' call to load specific program classes based on string identifiers.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a lifecycle that centers on ingesting untrusted external datasets to optimize and compile prompts, creating a surface for data-driven injection attacks.
- Ingestion points: The compile.py recipe in R2-versioning-recipes.md reads data directly from 'data/devset/v3.jsonl'.
- Boundary markers: While the SOP uses SHA256 hashes for version integrity, it lacks explicit instructions or boundary markers to prevent malicious instructions embedded in datasets from influencing the compiled output.
- Capability inventory: The skill's recipes include capabilities for subprocess execution (git commands) and extensive file system operations.
- Sanitization: The SOP does not include steps for sanitizing, escaping, or filtering the input data used in the prompt optimization loop.
Audit Metadata