chief-of-staff
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to coordinate sub-agents and process information from external, potentially untrusted data sources which creates a surface for indirect prompt injection attacks.
- Ingestion points: The skill instructions in 'SKILL.md' explicitly mention using 'Logs from critical running processes', 'Access to test environment databases', and 'Access to the browser' as data sources for the agent.
- Boundary markers: The skill provides a mitigation by instructing the agent to 'Prepare learning-driven instruction changes for review' and 'Propose evidence-backed environment improvements', ensuring a human-in-the-loop checkpoint before actions are taken.
- Capability inventory: The skill utilizes the '/pstack-swarm' tool (as noted in 'SKILL.md' and 'UPSTREAM.md') to delegate tasks to background agents and is empowered to modify the development environment (lint rules, coding standards, and schedules).
- Sanitization: There is no evidence of technical sanitization, filtering, or escaping of the ingested data sources within the provided instructions.
Audit Metadata