work
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it reads and executes tasks based on an external file that could be influenced by untrusted inputs (e.g., ticket descriptions or issue comments processed in a previous phase).
- Ingestion points: The skill explicitly reads its execution instructions from a contract file at
.backend/<YYYYMM>/<slug>/explore.mdduring Phase 0. - Boundary markers: The skill attempts to mitigate risks through structural validation (verifying specific report sections) and requiring a manual restatement of the plan, but it lacks explicit instruction-guarding delimiters or warnings to ignore embedded commands in the ingested data.
- Capability inventory: The skill has broad capabilities, including modifying arbitrary source files across multiple services and executing shell commands for testing and building (e.g.,
./gradlew,npm,vitest). These capabilities are triggered directly by the contents of the ingested file. - Sanitization: No explicit content-level sanitization, escaping, or filtering is performed on the plan data before it is used to drive the agent's implementation actions.
Audit Metadata