roast
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided business ideas via the
$ARGUMENTSvariable and interpolates this content into prompts for five independent subagents (Critic, Champion, Analyst, Investigator, Customer). This creates a theoretical surface for indirect prompt injection where an adversarial idea description could attempt to manipulate the subagents' behavior. - Ingestion points: Primary ingestion occurs in
SKILL.mdwhere user input is passed toscripts/brief_builder.pyand then to subagent task calls. - Boundary markers: The skill uses a
[brief]placeholder within instructions to signify the end of the system instructions and the start of user data, though it lacks explicit 'ignore' delimiters to protect against embedded instructions. - Capability inventory: The skill utilizes web search capabilities (specifically for the Investigator subagent), subagent orchestration, and local execution of included Python scripts.
- Sanitization: There is no evidence of automated sanitization or escaping of the user-provided text before its inclusion in prompts.
Audit Metadata