ds-best-of-n
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute build commands, test suites, and probes on artifacts generated during the process. While this is the intended functionality for a coding-related agent, executing generated scripts carries an inherent risk of running arbitrary or unintended code if the generated content is malicious or contains errors.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where a main orchestrator agent ingests and evaluates artifacts and notes created by independent subagents, creating an attack surface for indirect prompt injection.
- Ingestion points: The orchestrator agent reads subagent artifacts and their accompanying notes on rejected alternatives in SKILL.md.
- Boundary markers: The skill suggests some isolation by running subagents in separate temporary folders or git worktrees and keeping the evaluation rubric private from the subagents.
- Capability inventory: The agent has the capability to execute commands (builds/tests) and modify files (grafting logic).
- Sanitization: There is no explicit instruction to sanitize or validate the subagent output for hidden instructions before the orchestrator processes it.
Audit Metadata