coordinator
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external project files which could contain malicious instructions if the source files are untrusted or compromised.
- Ingestion points: The agent reads project state from
.work-state/queue.jsonand markdown files within the.work-state/coordinator/directory, includingvision.md,backlog.md, anddecisions.md. - Boundary markers: The instructions do not define boundary delimiters or specific warnings to prevent the agent from following instructions embedded within the processed data.
- Capability inventory: The skill has the capability to write to the file system (appending to
pulse-log.md) and generates command recommendations for the user to execute. - Sanitization: No sanitization, filtering, or validation steps are described for the content ingested from the external markdown and JSON files.
Audit Metadata