agent-hierarchy
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a delegation mechanism that loads instructions and system prompts from external reference files, creating a vulnerability surface if those files are modified by untrusted sources.
- Ingestion points: Instructions in
SKILL.mddirect the agent to load and follow content fromreferences/{role}.md(e.g.,backend-dev.md,architect.md) to define sub-agent behavior or its own perspective. - Boundary markers: The skill does not provide explicit markers or instructions to treat the content of these external reference files as untrusted or to ignore embedded instructions.
- Capability inventory: The skill grants the agent scope to read and modify sensitive project files (e.g.,
package.json,supabase/migrations/,.env.example) and demonstrates usage of theclaudeCLI for delegation, which involves shell command execution. - Sanitization: There is no evidence of sanitization or validation performed on the content of the reference files before they are interpolated into the agent's context or system prompt.
Audit Metadata