iterative-self-review
Warn
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The sub-agent is authorized to execute git-related shell commands (such as git diff, git log, git status, git show, and git blame) to inspect the working environment.
- [DATA_EXFILTRATION]: The instructions in sub_agent_prompt_template.md explicitly state that the Read tool should be used with absolute paths and that files outside the current working directory are in scope if cited in the response. This allows for the exposure of sensitive system files or credentials if they are referenced in the generated text.
- [EXTERNAL_DOWNLOADS]: The sub-agent is permitted to use the WebFetch tool to access any URL that is explicitly quoted in the assistant's response, enabling network access based on content that may be influenced by untrusted input.
- [PROMPT_INJECTION]: The skill processes untrusted user input and assistant responses by interpolating them verbatim into the sub-agent's prompt, creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted content enters the sub-agent's context via the {{USER_INPUT}} and {{MAIN_RESPONSE}} variables in references/sub_agent_prompt_template.md.
- Boundary markers: The prompt uses specific markdown headers (### (1) and ### (2)) as delimiters between instructions and untrusted content.
- Capability inventory: The sub-agent has capabilities to read files (including absolute paths), list directories, use git, and access the network via WebFetch.
- Sanitization: The instructions specifically mandate verbatim quotes and do not perform any escaping, validation, or filtering of the interpolated external content.
Audit Metadata