red-green-proof
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing project source code, Git logs, and test results, which creates a surface where malicious content within those files could influence agent behavior.
- Ingestion points: The agent is instructed to read project source files, Git history via
git log -S, and test evidence records (viascripts/red_green_evidence.py). - Boundary markers: The instructions do not define delimiters or explicit "ignore embedded instructions" warnings for the agent when processing content from the project under test.
- Capability inventory: The skill utilizes shell commands for file operations (
cp), version control (git), and executing the project's native test runners. It also includes a local Python utility script. - Sanitization: No sanitization or validation of the content read from project files is performed before it is integrated into the agent's context.
- [METADATA_POISONING]: The skill's internal documentation contains contradictory information about its components.
- Evidence: The
scripts/README.mdclaims the skill is 'intentionally script-free' and that 'no language-specific or third-party automation is bundled here'. This contradicts the presence ofscripts/red_green_evidence.py, which is a Python script included in the skill and explicitly referenced for use inSKILL.md. This represents misleading metadata regarding the skill's technical footprint.
Audit Metadata