document-code
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection due to its requirement to process external, potentially untrusted data.
- Ingestion points: In Step 2 of the Workflow, the skill is instructed to read source code, tests, and specifically 'commit and PR history', which are external sources that could contain malicious instructions.
- Boundary markers: The skill does not define explicit delimiters or instructions to ignore commands embedded in the files or history being read.
- Capability inventory: The skill has the capability to write to the local filesystem to modify source code files.
- Sanitization: There are no documented sanitization or validation steps for the content ingested from the commit or PR history.
- Mitigation: The 'Hard constraints' section significantly reduces the risk by strictly prohibiting changes to executable behavior, symbol names, or logic, ensuring the agent only adds non-executable documentation artifacts.
Audit Metadata