look-into-it
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external chat threads (Slack) to define its investigation tasks and fixing logic.
- Ingestion points: External Slack thread content accessed via
slack_read_threadin the Digest step. - Boundary markers: Absent; there are no specified delimiters to separate untrusted chat content from agent instructions.
- Capability inventory: File system read/write/delete (writing
diagnostic-<slug>.mdplans and 'Implement' step), Slack tool access (slack_read_thread,slack_add_reaction), and execution of the/loopcommand. - Sanitization: Not specified for external content, though the skill requires human interaction (
AskUserQuestion) before running code experiments. - [DATA_EXFILTRATION]: The skill reads codebase materials, including identifiers such as file/table names and error strings, and is instructed to post 'milestone updates' back to a Slack thread. This facilitates the movement of technical codebase information to an external communication channel.
- [COMMAND_EXECUTION]: The skill invokes the
/loopcommand for periodic update checks and involves modifying the local filesystem to create implementation plans and apply fixes.
Audit Metadata