pstack-principles
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a discovery mechanism that enumerates and reads the full content of all files matching the
/pstack-principle-*pattern found in the host's skill index or configured skill roots. This ingestion of external instructions creates an attack surface where a malicious skill file placed in these directories could influence the agent's behavior to perform unauthorized actions during design, implementation, or review phases.\n - Ingestion points: Host skill index and configured filesystem skill roots (SKILL.md).\n
- Boundary markers: The skill attempts to define 'composition boundaries' and a 'calling contract', but these are high-level behavioral constraints for the AI rather than technical enforcement or sandboxing.\n
- Capability inventory: The skill is authorized to modify code, design documents, and project management tickets; it also orchestrates other tools such as
/domain-modelingand/code-review.\n - Sanitization: The instructions do not specify any validation, filtering, or sanitization of the content found within the discovered principle skills before they are applied to the active workflow.
Audit Metadata