sg-beat-reference
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary mechanism involves fetching and comparing output against external, untrusted references. Malicious instructions embedded in these references could influence the behavior of the agent loop.
- Ingestion points: External URLs, repositories, and published artifacts provided by the user as a 'bar'.
- Boundary markers: No explicit delimiters or instructions are provided to the subagents to ignore potential prompt injections within the fetched reference material.
- Capability inventory: The generated prompts utilize 'ultracode' and subagent orchestration, providing significant autonomous execution power.
- Sanitization: The skill does not suggest any sanitization or validation of the content retrieved from external sources before it is processed by the builders or critics.
- [REMOTE_CODE_EXECUTION]: The instructions list 'run the binary' as a valid method for an agent to obtain and evaluate a reference. This encourages the download and execution of untrusted executable files within the agent's environment.
- [DYNAMIC_EXECUTION]: The skill leverages 'ultracode' and parallel 'subagents' to perform autonomous quality grinding. These features allow for multi-step execution that could be exploited if the agent context is compromised by malicious reference data.
- [EXTERNAL_DOWNLOADS]: The core functionality depends on fetching 'real, fetchable' content from external domains (e.g., live websites, repositories), creating a consistent vector for untrusted data ingestion.
Audit Metadata