learn-second-opinion
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool for core operations such as fetching wiki content viamaestro wiki getand analyzing git diffs. These operations involve executing shell commands based on user-provided arguments. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from local files, wiki entries, and git diffs.
- Ingestion points: Content from file paths, wiki IDs (
type-slug), or gitHEAD/stageddiffs provided via user arguments (SKILL.md). - Boundary markers: The instructions do not define specific delimiters (e.g., XML tags or backticks) to wrap the ingested content when it is passed to the sub-agents for analysis.
- Capability inventory: The orchestration agent has access to
Bash,Write,Edit, andspawn_agents_on_csv. Spawned persona agents are explicitly instructed not to modify files or call spawn tools, which significantly mitigates the risk of an injection attack leading to unauthorized changes. - Sanitization: There is no explicit sanitization or filtering of the target content before analysis.
Audit Metadata