think
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a reasoning process that ingests and acts upon untrusted external data, creating a surface for indirect prompt injection. \n
- Ingestion points: Instructions in SKILL.md direct the agent to 'Read the actual inputs, current state, constraints, failures, and prior work' (Stage 1) and attend to 'error messages, dissent, edge cases' (Stage 3). \n
- Boundary markers: Absent. There are no instructions to treat external data with delimiters or to ignore embedded instructions. \n
- Capability inventory: The skill is designed to guide 'consequential or ambiguous reasoning and decisions' and produce recommendations. This influence over the agent's logic affects how it will use subsequent tools and mutations. \n
- Sanitization: Absent. The skill lacks guidance on validating, escaping, or filtering external content before it is incorporated into the reasoning loop.
Audit Metadata