mycelium
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary assertions which are later retrieved and presented to the AI agent, creating a surface where malicious project data could influence the agent's behavior.
- Ingestion points: Data is ingested through the
proposeandamendverbs described in SKILL.md and references/log.md, which accept subject, predicate, and object literals. - Boundary markers: While the skill uses Markdown formatting (via
query --brief) to structure output, it lacks explicit boundary instructions for the agent to disregard instructions potentially embedded within assertion objects. - Capability inventory: The skill manages local file I/O for the log files located in project state directories (SKILL.md, references/log.md), but it does not perform network operations or execute arbitrary system commands.
- Sanitization: The skill enforces a project-specific schema defined in
.agents/mycelium.yml, ensuring that only declared domains, types, and predicates are accepted into the log.
Audit Metadata