agent-self-eval
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data sources to generate its evaluation reports. * Ingestion points: In
SKILL.md, Step 1 explicitly gathers 'Original user request' and 'User feedback' as inputs for scoring. * Boundary markers: The instructions lack clear delimiters (e.g., XML tags or triple quotes) to isolate the untrusted content from the evaluation logic. * Capability inventory: The skill is designed to write YAML blocks (Step 4) and modifyteam-toolkit.md(Integration Points), creating a path for malicious input to influence system instructions. * Sanitization: No sanitization or escaping of the ingested content is defined before it is used to generate reports or file updates. - [DYNAMIC_EXECUTION]: The skill dynamically generates YAML 'instinct' blocks and updates other instruction files (
team-toolkit.md) based on the results of evaluating untrusted input. While this follows a template, the content is derived from external data, posing a risk of instruction propagation where a malicious input could lead to the agent persisting unsafe 'instincts' or documentation notes. - [NO_CODE]: The skill contains no external scripts or executables, consisting entirely of markdown instructions and YAML configuration.
Audit Metadata