iterate-research
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data including feedback files, artifact comments, and repository evidence to revise technical documents. This introduces a vulnerability surface where malicious instructions could be embedded in the processed data.
- Ingestion points: The skill ingests data from user-specified feedback files (SKILL.md Step 2),
<comments>XML blocks (references/comment_feedback.md), and codebase evidence retrieved via analysis tools. - Boundary markers: While the instructions define a "narrow trust boundary" and require explicit user identification of feedback sources, they lack robust technical sanitization to prevent the model from potentially following adversarial instructions hidden within that feedback.
- Capability inventory: The skill can write to the file system ("Recompose the artifact in place"), perform codebase analysis using specialized tools, and conduct web research via
web-search-researcher. - Sanitization: No specific technical sanitization or escaping mechanisms are mentioned to mitigate the risk of processing malicious instructions in feedback.
Audit Metadata