aggregation-processor
Warn
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: In SKILL.md, the _resolve_consensus method within the ConflictResolver class calls eval() on stringified values derived from sub-task results. This allows code embedded in those results to be executed by the Python interpreter during the aggregation process.
- [PROMPT_INJECTION]: The skill processes untrusted data in the aggregate method without implementing boundary markers or sanitization, creating a surface for indirect prompt injection where malicious instructions in sub-task results could exploit the dynamic execution capability.
- [PROMPT_INJECTION]: Mandatory Evidence Chain:
- Ingestion points: aggregate method in AggregationProcessor (SKILL.md).
- Boundary markers: Absent; sub-task results are processed directly without delimiters.
- Capability inventory: Arbitrary Python execution via eval() in ConflictResolver.
- Sanitization: No filtering or escaping is applied to result content before evaluation.
Audit Metadata