diagnosing-root-causes
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from logs, user reports, and external websites, creating a surface for indirect prompt injection. The skill implements proactive defenses by instructing agents to treat such content as data rather than instructions and to flag suspicious content. * Ingestion points: The RESOURCES and ISSUE inputs in SKILL.md and subagents/evidence-collector.md allow for the processing of arbitrary external content. * Boundary markers: Instructions in SKILL.md and subagents/evidence-collector.md explicitly direct agents to ignore imperative text in evidence data. * Capability inventory: The skill can execute read-only repository commands (such as git history) and local builds/tests in disposable environments (Tier A and Tier B actions). * Sanitization: The rca-report-reviewer subagent is tasked with verifying that potential injection flags are surfaced and that instructions embedded in data were not followed.
- [EXTERNAL_DOWNLOADS]: The skill references external documentation from well-known and trusted providers including GitHub, GitLab, AWS, and Google for troubleshooting purposes.
- [COMMAND_EXECUTION]: The skill performs repository inspection and local verification using tools like git and local test runners. It strictly enforces safety tiers defined in references/safety-tiers.md, preventing the execution of commands that affect production, credentials, or shared state.
Audit Metadata