chief-of-staff
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting data from external sources that could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The agent is instructed to use 'context pointers' such as research notes and previous commits (SKILL.md, line 20), as well as logs from running processes and test environment databases (SKILL.md, lines 29-30).
- Boundary markers: There are no defined delimiters or specific instructions for the agent to treat these external inputs as data only and ignore any embedded natural language instructions.
- Capability inventory: The agent has broad permissions to coordinate subagents and 'modify the environment' (SKILL.md, line 11), which includes changing APIs, functions, lint rules, and coding standards (SKILL.md, lines 24-26).
- Sanitization: The instructions do not mandate any sanitization, validation, or human-in-the-loop verification before the agent acts upon information found in the ingested data sources.
Audit Metadata