reviewing-agent-designs
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (user artifacts like skills, plugins, and workflows) which presents a vulnerability surface for indirect prompt injection attacks.
- Ingestion points: The skill reads user-selected files locally, including
SKILL.md, plugin manifests (.mcp.json), hook configurations, and scripts as documented in the "Locate the artifact inline" section. - Boundary markers: The skill uses explicit delimiters and encoding to isolate untrusted data, specifically
BEGIN_UNTRUSTED_ARTIFACT_PATHS/END_UNTRUSTED_ARTIFACT_PATHSandBEGIN_UNTRUSTED_USER_CONCERNS/END_UNTRUSTED_USER_CONCERNSmarkers. - Capability inventory: The skill has the capability to read local files, execute platform-specific
atlas_*tools, and dispatch tasks to a subagent (design-auditor). - Sanitization: The instructions mandate that all untrusted data be treated as inert, never followed as instructions, and specifically JSON-encoded before being passed to subagents to prevent control character escapes.
Audit Metadata