work-on-task
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external task data which could contain instructions designed to manipulate agent behavior.
- Ingestion points: Untrusted data enters the agent context through the
task textandattachmentsprovided in the message or retrieved by thetask-context-gatheringscript (SKILL.md, content.md). - Boundary markers: The instructions do not define any specific delimiters or "ignore instructions" warnings to separate task content from system-level instructions.
- Capability inventory: The skill is capable of executing internal scripts (
task-context-gathering), invoking other skills (researching,planning,implementing), performing git operations (git status,git push), and interacting with the file system viaagent-fs(SKILL.md). - Sanitization: No sanitization, validation, or escaping of the external task content is mentioned before it is processed or used to guide agent actions.
Audit Metadata