composing-agent-prompts
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external repositories, including files, issues, and commit history, which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: Target repository files, issues, commits, and command outputs (SKILL.md).
- Boundary markers: Includes specific instructions to treat all repository data as data, not instructions, and to emit the final prompt within a fenced code block to prevent accidental execution by the host.
- Capability inventory: File reading, external skill invocation (improving-prompts), file writing (--out), and shell command execution to verify repository facts.
- Sanitization: Instructions explicitly prohibit quoting secrets or untrusted text, requiring the use of file path citations instead.
- [COMMAND_EXECUTION]: The skill instructs the agent to discover and record commands used by the target repository (such as build, test, or lint scripts) and to use these commands to verify facts. Executing scripts or commands discovered in an untrusted repository presents a risk if the repository contains malicious tooling.
Audit Metadata