arena
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes a 'task' and 'shared grounding' in Phase B which are then fanned out to multiple subagents. This creates a surface where malicious instructions embedded in the task could influence the runners or the judge subagent.
- Ingestion points: Untrusted data enters the context as the 'task' and 'shared grounding' in Phase B (SKILL.md).
- Boundary markers: The skill does not prescribe the use of boundary markers or 'ignore' instructions when passing the task content to subagents.
- Capability inventory: The skill uses tool capabilities to spawn subagents (
run_in_background: true), read configuration from the home directory (e.g.,~/.cursor/rules/pstack-models.mdc), and write to the filesystem (e.g.,/tmp/arena-...). - Sanitization: There is no mention of sanitizing, escaping, or validating the 'task' content before interpolation into the subagent prompts.
Audit Metadata