work-autonomous
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted or external sources which may contain malicious instructions meant to subvert agent behavior.
- Ingestion points: The skill reads from
INBOX/(including informal, non-formalized entries),TODO.md,AUFGABEN.txt, and other project files as part of its normal operating model in Tier 1 and Tier 2. - Boundary markers: The protocol does not explicitly instruct the agent to use delimiters or specific boundary markers to isolate data from instructions when processing these sources.
- Capability inventory: The skill utilizes significant system capabilities, including file system access and shell command execution via tools like
usmcandgardenerto perform project work and manage state. - Sanitization: No explicit sanitization, filtering, or validation logic is defined for the content retrieved from the task ingestion points.
Audit Metadata