answering-cross-repo-request
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and act upon data from external sources, specifically
<cross-session-message>inputs from other AI sessions. - Ingestion points: Incoming messages from peer sessions asking for repository changes (endpoints, fields, client updates).
- Boundary markers: The instructions mandate a human-in-the-loop (HITL) checkpoint by requiring the agent to summarize the request and get a 'yes' from the user before implementation. It also includes instructions to detect and refuse 'permission laundering' if a peer session attempts to bypass its own restrictions.
- Capability inventory: The skill implies the agent has permissions to read and modify local repository files, view schemas, and execute local verification commands like
bun test. - Sanitization: While the skill requires user review, it does not specify technical sanitization or isolation protocols for the content of incoming messages before the agent processes them, leaving a surface for instructions embedded in requests to influence the agent's behavior.
Audit Metadata