switch
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from external files (CLAUDE.md, CONTEXT-*-llm.md) and incorporates them into the active conversation context.
- Ingestion points: Phase 3 loads CLAUDE.md and CONTEXT-*-llm.md from the project directory.
- Boundary markers: The skill does not implement delimiters or safety warnings to distinguish these external instructions from the agent's core instructions.
- Capability inventory: The skill utilizes Bash for workspace resolution, Read for file content extraction, and Glob for discovery.
- Sanitization: No sanitization or validation of the loaded file content is performed.
- [PROMPT_INJECTION]: The skill instructions in Phase 3 and Phase 5 contain directives ("You MUST follow them", "This overrides default behavior") that command the agent to prioritize instructions found in external workspace files over its own default constraints and system prompt.
- [COMMAND_EXECUTION]: The skill executes shell commands via the Bash tool to resolve the workspace root (e.g., git rev-parse --show-toplevel).
Audit Metadata