super-swarm-spark
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown plan files which directly influence the behavior of the orchestrator and its parallel subagents.
- Ingestion points: The skill reads user-supplied plan files in
SKILL.md(Step 2) to build task lists and context packs. - Boundary markers: The prompts constructed for subagents do not include explicit delimiters or instructions to ignore potential commands embedded within the plan data.
- Capability inventory: Both the orchestrator and subagents have extensive capabilities, including file reading/writing, staging/committing code changes, and executing arbitrary test commands during validation steps.
- Multi-step chains: Subagents are directed to update the plan file (
*-plan.md) as they complete tasks. If a plan contains malicious content that compromises a subagent, that subagent could modify the plan to include further instructions that the orchestrator will process during its final integration and testing pass (Step 6). - Sanitization: There is no evidence of sanitization or schema validation for the data extracted from the plan files before it is used to drive agent actions.
Audit Metadata