audit-slop
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust multi-agent orchestration framework using standard platform tools (
TeamCreate,Agent,TaskCreate). It includes a mandatory skeptic (Doubt Augur) who must approve the audit brief and adjudicate findings, preventing unverified or hallucinated outputs.\n- [SAFE]: Strict write-safety rules ensure that no agent modifies the source code, specifications, or user stories being audited. All agents are restricted to role-scoped progress files, maintaining the integrity of the target codebase.\n- [SAFE]: Non-negotiable shared principles explicitly prohibit the inclusion of secrets, API keys, or PII in agent prompts or outputs, effectively managing the risk of credential exposure during the audit process.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) due to its core function of analyzing untrusted code.\n - Ingestion points: Reads source files, git logs, and dependency manifests across the entire codebase scope.\n
- Boundary markers: None identified in the agent prompts; agents are instructed to read the target files directly without explicit delimitation.\n
- Capability inventory: Agents have file-read access, the ability to write progress reports, and inter-agent communication tools; the orchestrator can spawn new agents.\n
- Sanitization: No sanitization or escaping of the audited code is performed before it is provided to the LLM agents. This is mitigated by the structured adjudication phase where findings are cross-examined.
Audit Metadata