rulecheck
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill launches an autonomous agent that reads and acts upon external data sources, including the codebase, AGENTS.md, and architectural guides. This creates a surface for indirect prompt injection where malicious instructions embedded in project files could potentially influence the agent's behavior.
- Ingestion points: Processes user input via $ARGUMENTS and reads content from AGENTS.md, .archon/engineering.md, and project source files.
- Boundary markers: The SKILL.md orchestrator instructions establish clear operational boundaries, directing the main agent to launch the sub-agent without performing scanning or fixing tasks itself.
- Capability inventory: The system is capable of performing file modifications, executing shell commands (e.g., git, gh, bun), and creating pull requests.
- Sanitization: A PreToolUse hook (hooks/block-dangerous.sh) is implemented to intercept and block destructive commands such as force pushes, hard resets, and recursive removals of absolute paths.
- [DATA_EXFILTRATION]: The skill includes a Stop hook (hooks/slack-notify.sh) that transmits a summary of the agent's run and generated pull request URLs to an external service. This operation targets a Slack webhook URL provided by the user via the SLACK_WEBHOOK_URL environment variable. The transmission occurs automatically upon agent completion to provide project status updates.
Audit Metadata