ketchup
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize external content, creating a vulnerability surface where malicious instructions embedded in chat messages or subagent reports could influence the agent's behavior.
- Ingestion points: The skill explicitly collects "reports from subagents" and "messages from anyone else in this chat" to generate its summary (SKILL.md).
- Boundary markers: The instructions do not include specific delimiters or warnings to ignore instructions contained within the collected data.
- Capability inventory: Although the skill instructions mention keeping the turn "read-only," it specifically commands the agent to "make [a visual]" if one does not exist, including Mermaid diagrams, charts, or generated images (SKILL.md).
- Sanitization: No sanitization, escaping, or validation of the ingested content is performed before processing.
Audit Metadata