persona-selector
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted 'task keywords/intent' to rank and route work to candidate personas, creating a potential surface for indirect instructions to influence agent routing.
- Ingestion points: Task specifications and intent keywords processed in the 'Selection' phase.
- Boundary markers: The skill uses a formal 'CONTRACT' schema to wrap delegated tasks, providing structural delimiters.
- Capability inventory: The skill is limited to internal persona selection and delegation within the agent's defined environment.
- Sanitization: Implements an 'Approved-target enum' check, ensuring all delegation targets exist in the official registry to prevent hallucination-based injections.
- [DYNAMIC_EXECUTION]: The skill supports 'Bounded self-refinement' where personas can update their instructions based on successful outcomes via the 'brain/learning-adaptation.skill'.
- Evidence: The 'Bounded self-refinement' section describes markdown-level refinement of persona logic.
- Mitigation: The skill explicitly restricts these refinements to successful outcomes only, mandates auditability, and declares that core security mandates and scopes are immutable.
Audit Metadata