cfd-reviewer
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the orchestrator and other agents, including simulation plans and mathematical outputs. This constitutes an attack surface where instructions embedded in the processed data could influence the agent's behavior.
- Ingestion points: Defined in Section 4.1, including 'Simulation plan or setup', 'Mathematician output', and 'Error history'.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing these inputs.
- Capability inventory: The skill utilizes 'Read' and 'Write' tools and is authorized to provide specific code-level fixes for subsequent execution.
- Sanitization: No explicit sanitization, escaping, or validation of the ingested text is mentioned.
- [COMMAND_EXECUTION]: The skill provides specific, actionable code fixes and parameter adjustments (e.g., 'reduce relaxation factor', 'add gmsh.model.occ.synchronize()') intended for automated application or execution by the cfd-bioreactor orchestrator. This design creates a path for command injection if the reviewer's logic is subverted through processed data.
Audit Metadata