chief-of-staff
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill serves as a central hub that ingests user questions ('founder questions') and routes them to up to 33 other specialized advisor roles. This architecture creates a significant surface for indirect prompt injection, where malicious instructions embedded in the user question could influence the behavior of the invoked sub-skills.
- Ingestion points: Untrusted user input enters the context via the 'Invocation Syntax' defined in
SKILL.mdand through 'company context' loaded at session start. - Boundary markers: The skill lacks explicit boundary markers or 'ignore embedded instructions' warnings when relaying user-supplied questions to other advisor roles.
- Capability inventory: While the skill itself does not perform dangerous operations like network calls or subprocess execution, it possesses high capability in its ability to trigger dozens of other specialized skills.
- Sanitization: There is no evidence of input validation or sanitization to ensure that the content of the question being routed does not contain instructions targeting the advisor roles.
Audit Metadata