pstack-arena
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes artifacts and rationales generated by 'candidate' agents, which constitutes an ingestion point for untrusted data.
- Ingestion points: Candidate outputs are read and evaluated in steps 2 and 3 of the workflow defined in
SKILL.md. - Boundary markers: The skill does not provide explicit delimiters or instructions to ignore embedded commands within the candidate artifacts being judged.
- Capability inventory: The skill uses the
/pstack-swarmtool for execution and judging, and writes to isolated output directories or worktrees. - Sanitization: No explicit sanitization or validation logic is defined for the candidate content before it is processed by the judge.
- [METADATA_POISONING]: The
short_descriptionfield inagents/openai.yamlis truncated ('...blind judging, base '), representing an incomplete metadata field.
Audit Metadata