debate
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inputs from repository contents, source issues, vendor ledgers, and external panel outputs, which introduces an indirect prompt injection attack surface.
- Ingestion points: Ingests untrusted external content into the agent context in
SKILL.mdwithin Step 1 (Resolving source issues) and Step 3 (Ingesting round data from external slots). - Boundary markers: Employs defensive isolation measures, including wrapping disputed points via the
untrusted file-blockcommand and verifying pre-wrapped title blocks. - Capability inventory: Restricts file writes via a scoped PreToolUse hook (
deny-edit-write.sh) to$DEBATE_TMPDIR, but retains the capability to execute complex orchestration shell commands vialarch.shand spawn a subagent (larch:debater). - Sanitization: Expressly instructs the agent to treat all repository content, subjects, and vendor output as untrusted evidence rather than instructions.
Audit Metadata