cross-eval
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (board memos or strategy briefs) using multiple LLMs, creating a surface for injection attacks.
- Ingestion points: The skill takes a
<memo-or-brief>input as described inSKILL.md. - Boundary markers: The instructions use simple quotes to delineate the memo content but do not include robust XML-style delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill workflow involves writing files to
~/.claude/cross-eval/and invoking external CLI tools (codex,gemini), which could be targeted by an injection attack. - Sanitization: There is no mention of sanitizing, filtering, or validating the input text before passing it to the models.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to probe the environment for and potentially execute external command-line tools (
codexandgemini).
Audit Metadata