devils-advocate
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The main instruction file (SKILL.md) directs the agent to invoke local Python scripts (argument-graph.py, thought-chain.py) using the uv run command to manage internal state during analysis phases.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it instructs the agent to embed the $ARGUMENTS variable, which contains untrusted user input, directly into shell command templates without escaping or sanitization.
- Ingestion points: Untrusted data enters via the $ARGUMENTS placeholder in SKILL.md.
- Boundary markers: No protective delimiters or sanitization instructions are present in the shell command templates.
- Capability inventory: The workflow relies on multiple subprocess executions of state-management scripts via uv run.
- Sanitization: No input validation or shell-escaping logic is provided for the interpolated arguments.
- [COMMAND_EXECUTION]: The state-management scripts utilize hardcoded, predictable file paths in the system temporary directory (/tmp/devils-advocate-graph.jsonl and /tmp/devils-advocate-chain.json) to store graph and chain data, which could allow for local data tampering or symlink attacks in shared environments.
Audit Metadata