next-big-thing
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill performs a comprehensive scan of all repository files and autonomously implements "small-stuff" modifications without user approval. This ingestion of untrusted data from repository files (such as documentation, comments, or configuration files) combined with autonomous file-writing capabilities creates a significant surface for indirect prompt injection attacks.
- Ingestion points: The workflow begins by scanning the entire repository (
Scan the whole repo) inSKILL.md. - Boundary markers: There are no explicit markers or instructions to treat repository content as untrusted data rather than instructions.
- Capability inventory: The agent has the authority to write and modify files during the "Ship the small stuff" phase (Step 3) and the "Implement the approved feature" phase (Step 5).
- Sanitization: The skill does not mention any sanitization or validation of the content read from the repository before it is processed or used to generate code changes.
- [PROMPT_INJECTION]: The skill instructions define a mechanism to bypass its own safety constraints (
Skip the user's approval if the user has explicitly said "yolo-decision"). This allows the agent to autonomously implement high-impact, "Extreme" changes that would otherwise require a human-in-the-loop decision, effectively overriding the intended safety workflow.
Audit Metadata