dev-soft-agent
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to automatically ingest data from project source code and task lists using
TaskEngine.scan_for_tasksandTaskEngine.parse_aufgaben. This content, which can include arbitrary text fromTODOorFIXMEcomments, is interpolated into thetask_prompt.txttemplate via the{{TASK_DESCRIPTION}}variable. This creates a vulnerability surface where a malicious project could contain embedded instructions that compromise the agent's behavior during a development loop.\n - Ingestion points:
scripts/task_engine.pyreads content from files within the project directories being scanned.\n - Boundary markers: The prompt templates in
scripts/prompt_templates/do not use delimiters or instructions to treat the interpolated task content as untrusted data.\n - Capability inventory: The agent is explicitly instructed to plan and execute code modifications based on the descriptions provided in the tasks, as seen in
scripts/prompt_templates/task_prompt.txt.\n - Sanitization: The skill does not perform any validation or filtering on task descriptions before they are included in the instructions sent to the agent.
Audit Metadata