route
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to forward user input verbatim to classification tools and subagents, which is a standard pattern for routing skills but creates an attack surface for instructions embedded in user data.
- Ingestion points: User requests are processed in Step 1 (classification) and Step 4 (dispatch) as described in
SKILL.md. - Boundary markers: The instructions do not specify the use of strong delimiters (e.g., XML tags or specific markdown blocks) to isolate the untrusted user input when it is passed to subagents.
- Capability inventory: As detailed in
SUBAGENTS.md, the subagents being routed to (such asimplementer-heavy) are intended to have broad capabilities including multi-file refactors, architecture changes, and security-sensitive edits. - Sanitization: The skill explicitly discourages paraphrasing to avoid losing detail, which results in raw input being passed through without sanitization or filtering.
Audit Metadata