why
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large amounts of potentially untrusted data from various sources, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads PR bodies, review threads, ticket descriptions, chat messages, and documentation via git and various MCP servers (as specified in references/anchor.md and references/sources/*.md).
- Boundary markers: The skill lacks explicit structural delimiters or sanitization instructions for the ingested content, though references/epistemics.md and references/synthesizer.md provide cognitive frameworks for evaluating data as evidence.
- Capability inventory: The skill utilizes read-only tools for repository and external source analysis (git, gh, MCP read tools), limiting the potential impact of an injection.
- Sanitization: No explicit sanitization or filtering of external content is mentioned before it is processed by subagents or the synthesizer.
Audit Metadata