refactor
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data that could contain malicious instructions designed to influence agent behavior.
- Ingestion points: Data is ingested from repository source code,
.simplify/ledger-*.mdfiles, and external reports or finding lists (SKILL.md Phase 0). - Boundary markers: The skill follows specific document formats (ledgers) but lacks explicit delimiters or instructions to ignore embedded commands within those external inputs.
- Capability inventory: The skill possesses significant capabilities including modifying source code, renaming definitions across the tree, and deleting code via
refactor_tooland file system writes (SKILL.md Phase 3). - Sanitization: There is no mention of sanitization, filtering, or escaping for content read from external ledgers or reports before it is processed by the agent.
- Mitigation: A dedicated 'Phase 2 — Approval' acts as a critical security control, requiring the user to individually approve every planned move before any code modification occurs.
Audit Metadata