arena
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where a 'parent' agent reads and synthesizes content produced by several 'candidate' sub-agents. This creates a surface for indirect prompt injection if a candidate produces output containing instructions designed to override the parent agent's logic during the 'Graft' or 'Verify' phases.
- Ingestion points: The skill instructions in Phase D ('Read every candidate end to end') and Phase E ('Walk each losing candidate once more') require the agent to process external data.
- Boundary markers: The skill does not provide clear delimiters or 'ignore embedded instructions' warnings for the parent agent when reading candidate outputs.
- Capability inventory: The skill involves spawning sub-agents (background tasks), writing to the local filesystem (/tmp/arena-...), and reading local configuration files (~/.cursor/rules/pstack-models.mdc).
- Sanitization: There is no evidence of sanitization or validation of the text provided by sub-agents before it is grafted into the final output.
Audit Metadata