gm-edit
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The 'Finish the work' section instructs the agent to be highly persistent, stating that 'a run that stops with work left undone is incomplete'. It specifically directs the agent to 'repair the fault where it originates' when a step is blocked. This directive could encourage the agent to attempt to disable or bypass security controls, environmental constraints, or safety filters if it identifies them as the 'fault' blocking its progress.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from a 'PRD row' (
row=<id>). If these rows contain untrusted content from external sources (e.g., tickets, pull requests), they represent an attack surface for indirect prompt injection. - Ingestion points: The
rowparameter inSKILL.mdidentifies data to be processed from the.gm/environment. - Boundary markers: There are no explicit delimiters or warnings to ignore instructions embedded within the data rows.
- Capability inventory: The skill has the capability to perform 'exact-match edits' on the filesystem, run code analysis tools ('callers'), and invoke subsequent skills (
gm-eliminate,gm-validate). - Sanitization: No sanitization or validation of the input row content is described.
Audit Metadata