work-refute
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates the use of deterministic tools such as
grep,git, and test runners as 'direct oracles' to verify factual claims before using sub-agent judgment. - [PROMPT_INJECTION]: The skill processes user-supplied claims and findings by interpolating them into instructions for sub-agents ('refuters'). While this creates a potential surface for prompt injection, the risk is mitigated by the 'hostile skeptic' persona and the requirement for sub-agents to verify evidence from source files.
- Ingestion points: User-provided claim strings are ingested through the
/work-refutecommand. - Boundary markers: The prompt template uses double quotes (e.g.,
\"[CLAIM]\") to delimit the user input. - Capability inventory: The main agent and sub-agents have capabilities for file system access, shell command execution, and sub-agent orchestration.
- Sanitization: Input is handled as strings; no explicit sanitization of the claim text is described before interpolation into the prompt template.
Audit Metadata