convergence-loop
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes repository content (manifests, docs, and source code) as part of its auditing workflow, presenting a surface for indirect prompt injection. This is mitigated by the design which routes paths to sub-agents and uses independent skeptical verification to validate findings.\n
- Ingestion points: The skill reads package manifests, workspace layouts, documentation, and CI configurations to inventory surfaces as described in SKILL.md.\n
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified in the orchestration logic.\n
- Capability inventory: The system can read project files and write findings to a local markdown ledger and logs. It spawns subprocesses for auditor and skeptic agents.\n
- Sanitization: The orchestrator relies on paths and structured results rather than interpolating source code into its own context, reducing the attack surface.\n- [COMMAND_EXECUTION]: The orchestration logic utilizes dynamic script generation and optional scheduled triggers for workflow reliability and task resumption.\n
- Evidence: SKILL.md describes persisting each batch as a script with inlined literal configurations to ensure 'resume-safety' and relaunching failed batches as fresh runs.\n
- Persistence: It mentions an optional 'babysitter' mechanism using environment-provided scheduled triggers to handle rate-limiting or crashes, though no implementation details that would suggest unauthorized persistence are provided.
Audit Metadata