diagnose
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, creating a potential surface for indirect prompt injection. \n
- Ingestion points: The
scripts/hitl-loop.template.tsscript captures raw user input via terminal prompts. Additionally,SKILL.mdinstructs the agent to process external artifacts like captured traces, error messages, and log dumps. \n - Boundary markers: The reproduction script uses a simple
--- Captured ---header to separate data, but there are no specific instructions for the agent to treat this data as untrusted or to ignore embedded instructions. \n - Capability inventory: The skill grants the agent permission to execute commands (Phase 1) and modify the codebase (Phase 5) based on the findings from the ingested data. \n
- Sanitization: There is no evidence of sanitization or validation of the input captured from the user or external log files before it is processed by the agent.
Audit Metadata