prism
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation provides a setup command
npx skills add argahv/novelty-skills -g -y -s '*'to install the suite of 11 sub-agents required for the reasoning pipeline. This is a transparent setup process for vendor-owned resources.\n- [EXTERNAL_DOWNLOADS]: The skill requires downloading auxiliary thinking-pattern skills from the author's own novelty-skills repository to function as an orchestrator.\n- [PROMPT_INJECTION]: The skill processes user-supplied text as its primary input, which represents a standard surface for indirect prompt injection in orchestration workflows.\n - Ingestion points: User input passed as the analysis target (problem, decision, or design).\n
- Boundary markers: Absent; the orchestration logic relies on structured YAML for outputs but does not define delimiters for the input text.\n
- Capability inventory: Orchestrates 11 sub-agents through a multi-phase reasoning pipeline.\n
- Sanitization: No explicit sanitization or filtering of the user-provided input is specified in the instructions.
Audit Metadata