swarm
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses configuration files located in the user's home directory (e.g.,
~/.cursor/rules/pstack-models.mdc,~/.claude/rules/pstack-models.md,~/.agents/pstack-models.md) to determine which model to use for sub-agents. These paths are used for application-specific model configuration settings. - [INDIRECT_PROMPT_INJECTION]: The skill processes and aggregates terminal results from parallel workers in Phase C without providing explicit sanitization or boundary markers, creating a surface where malicious instructions embedded in worker output could theoretically influence the aggregation logic.
- Ingestion points: Terminal results from workers in Phase C (Aggregate).
- Boundary markers: No specific delimiters or validation schemas are mentioned for the worker reports.
- Capability inventory: Spawns sub-agents using platform-specific tools (
Task,Agent,task,spawn_agent), reads local configuration files, and writes consolidated reports. - Sanitization: No sanitization or escaping of worker results is defined before the consolidation step.
Audit Metadata