krt-product-polish-council
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python scripts (
scripts/check_atlas_freshness.py) that executegitcommands to verify the state of the repository. These executions usesubprocess.runwith arguments passed as a list and utilize the--separator to prevent command injection from potentially malicious file paths defined in the application atlas. - [INDIRECT_PROMPT_INJECTION]: The audit process involves sub-agents (Evaluators) reading and analyzing untrusted application source code and content. While this presents an attack surface for indirect prompt injection, the skill implements a multi-role 'Council' architecture and a formal synthesis protocol that requires explicit evidence (
observed,code,declared) for every finding, providing structural defense against adversarial content.
Audit Metadata