arena
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to manage workspaces and directories using system commands.
- Instructions include the use of
git worktree addto establish isolated environments for distinct task candidates. - The workflow involve creating and writing to temporary directories (e.g.,
/tmp/arena-<slug>/). - [INDIRECT_PROMPT_INJECTION]: The skill architecture, which involves one agent processing the output of several others, presents a surface for indirect prompt injection.
- Ingestion points: Data is ingested from local grounding documents (e.g.,
local://arena-grounding.md) and the textual outputs/rationales produced by parallel runner agents in Phase B. - Boundary markers (absent): The skill does not mandate the use of XML tags, delimiters, or specific 'ignore' instructions when runner outputs are passed to the 'reviewer' or 'picker' agents.
- Capability inventory: The skill allows for spawning multiple agent seats, writing to agent-specific URIs (
agent://), terminating processes (proc://), and accessing local configuration files such as~/.omp/agent/config.yml(SKILL.md). - Sanitization (absent): There are no prescribed sanitization or validation steps before 'grafting' logic from losing candidates into the final base artifact.
Audit Metadata