session-review
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read local project files and perform web searches to verify technology currency, which presents a surface for indirect prompt injection.
- Ingestion points: Local files and external web search results are processed by the agent and parallel reviewers (
SKILL.md). - Boundary markers: While the skill advises not to trust the internal summary brief, it lacks explicit instructions or delimiters to protect against malicious content embedded within the project files or web pages being reviewed.
- Capability inventory: The agent is authorized to modify files ("apply the cheap-safe fixes immediately"), spawn additional agent processes (
idea-validator), and access the network for technology validation. - Sanitization: No evidence of sanitization, filtering, or validation of the ingested content is present.
Audit Metadata