gauntlet-curate
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes local YAML data from
plugins/gauntlet/data/problems/which could contain embedded instructions intended to influence the agent's behavior during the curation process. - Ingestion points:
plugins/gauntlet/data/problems/*.yamland_manifest.yaml. - Boundary markers: None specified in the instructions to distinguish data from instructions.
- Capability inventory: Local script execution (
python scripts/curate_problems.py) and local file reading/surveying. - Sanitization: The skill explicitly uses
yaml.safe_load()in the validation step, which is a security best practice for parsing YAML data. - [COMMAND_EXECUTION]: The skill performs shell command execution to run a local analysis script and an inline Python snippet for schema validation. These commands operate on local repository paths and are consistent with the skill's stated purpose of auditing the codebase.
Audit Metadata