sdd-context-intake
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by design, as it is instructed to ingest untrusted data from multiple sources to create feature briefs.
- Ingestion points: Untrusted content enters the agent's context through user-provided text, the
Readcommand for local files,WebFetchfor external URLs, and ticket ingestion via CLI/MCP (SKILL.md). - Boundary markers: The instructions do not specify the use of delimiters or boundary markers to distinguish source content from agent instructions, nor do they include warnings to ignore embedded directives.
- Capability inventory: The agent has the ability to read local filesystem data, fetch external web content, delegate tasks to sub-agents, and pass synthesized data to downstream workflows like
sdd-clarifyandsdd-feature-flow(SKILL.md). - Sanitization: The skill lacks explicit instructions for sanitizing, escaping, or validating the ingested content before it is processed or passed to other tools.
- [DATA_EXFILTRATION]: The skill facilitates access to local files and external network resources based on user input.
- Evidence: The procedure explicitly directs the agent to "Read the named files" and "WebFetch the URLs" provided by the user (SKILL.md). While these are intended for legitimate context gathering, they provide the agent with the necessary primitives to access sensitive local information or communicate with arbitrary external endpoints.
Audit Metadata