how
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a local script
python3 <pstack-runtime>/scripts/roles.pyto determine role configurations based on provided environment variables and roles. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied questions and findings from multiple explorers, creating an attack surface where untrusted data influences subagent behavior.
- Ingestion points: The user question
{QUESTION}is interpolated intoSKILL.md,references/explainer-prompt.md, andreferences/explorer-prompt.md. - Boundary markers: The prompts explicitly state the exploration is read-only and forbid editing files, committing, or pushing code.
- Capability inventory: The skill uses
delegate_taskto spawn subagents and executes a shell-based Python script. - Sanitization: There is no evidence of input validation or escaping for the
{QUESTION}or{EXPLORER_FINDINGS_ALL}variables before they are injected into prompts.
Audit Metadata