Poteto Mode
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted external data, which could contain malicious instructions meant to influence the agent's behavior.
- Ingestion points: The agent is instructed to read conversation transcripts from the
agent-transcripts/directory, process cloud-agent URLs, and pick up work from git branches as described inplaybooks/session-pickup.mdandplaybooks/eval.md. - Boundary markers: There are no explicit instructions to use delimiters or "ignore embedded instructions" warnings when interpolating content from these external sources into the agent's context.
- Capability inventory: The agent has broad capabilities, including the ability to write files, spawn subagents with different models, and use any available MCP tools for environment interaction as stated in the Autonomy section of
SKILL.md. - Sanitization: While the
evalplaybook mentions blinding and sanitizing directory names for experiments, there is no general validation or escaping of the content read from transcripts or branches before it is processed.
Audit Metadata