quick
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to read and follow instructions from external files within the target repository.
- Ingestion points: The workflow explicitly instructs the agent to read
AGENTS.md,CLAUDE.md, and other nested instruction files found in the workspace. - Boundary markers: There are no defined delimiters or instructions to treat these external files as untrusted data or to ignore any embedded directives that might conflict with the skill's primary goals.
- Capability inventory: The skill possesses significant capabilities, including modifying source code, executing project scripts (e.g.,
node scripts/validate-project.mjs), running tests, committing changes to the git repository, and triggering deployment mechanisms. - Sanitization: The skill lacks any mechanism to sanitize, validate, or filter the content read from these external instruction files before it influences the agent's execution path.
Audit Metadata