council
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted code, diffs, plans, and documents, which are subsequently shared with multiple external model providers. This workflow presents an indirect prompt injection surface where malicious instructions within the reviewed files could attempt to influence the subagents or the orchestrating agent.
- Ingestion points: The skill reads local diffs, commit SHAs, documents, and plans from the repository for review (SKILL.md, Instructions 1 & 3).
- Boundary markers: There are no instructions for using specific delimiters or boundary markers to isolate the untrusted artifact content from the agent's instructions.
- Capability inventory: The skill uses harness delegation tools, such as
delegate_task, to transmit artifact data to external AI models (SKILL.md, Instructions 2 & 3). - Sanitization: The instructions do not specify any sanitization, filtering, or escaping of the target artifact content prior to delegation.
- [EXTERNAL_DOWNLOADS]: The skill provides a reference to its source repository on GitHub (
t3dotgg/tstack) for adaptation and licensing purposes. This is a neutral reference to a well-known developer's public repository.
Audit Metadata