how
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses a multi-agent architecture where 'explorer' subagents read files from a codebase and their findings are merged into the prompt of an 'explainer' subagent. This design allows untrusted data from the codebase to be interpolated into the agent's instructions.
- Ingestion points: Source code and documentation files within the repository being explored (facilitated by
references/explorer-prompt.md). - Boundary markers: The prompt template in
references/explainer-prompt.mdlacks clear delimiters (like XML tags or specific 'ignore instructions' warnings) for the{EXPLORER_FINDINGS_ALL}placeholder, relying only on markdown headers. - Capability inventory: The synthesized 'explainer' subagent possesses tools for codebase interaction including
Read,Grep, andGlob(as stated inreferences/explainer-prompt.md). - Sanitization: There is no evidence of sanitization or escaping of the findings before they are passed to the explainer subagent.
Audit Metadata