correct
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon data from external, potentially untrusted sources within the repository's history, such as commit messages, reverts, and review comments. If these sources contain malicious instructions, they could influence the agent's behavior during the 'correction' process.
- Ingestion points: The agent is directed to read recent commits, reverts, review comments, agent instruction files, and comments explaining workarounds in the SKILL.md file.
- Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between data to be analyzed and instructions to be followed within those sources.
- Capability inventory: The skill implies broad file modification capabilities (e.g., 'Change the repo so the next agent can't make them', 'Fix and prove') which increases the impact if an injection occurs.
- Sanitization: No sanitization or validation logic for the ingested historical data is mentioned in the instructions.
Audit Metadata