flow-repo-brief
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze untrusted repository content, such as source code, manifests, and configuration files, which establishes a potential surface for indirect prompt injection.
- Ingestion points: Phase 1 requires the agent to read
AGENTS.md, manifests, lockfiles, and nearby code within the user's repository. - Boundary markers: The skill specifies that the resulting brief is "never an authority above user or repository instructions," which acts as a contextual boundary for the agent, though no technical delimiters are enforced.
- Capability inventory: The skill utilizes the agent's native filesystem read/write capabilities to generate artifacts in
.plans/context/. - Sanitization: The instructions do not define specific sanitization routines for the data processed from the repository, relying on the agent's internal reasoning to filter information.
Audit Metadata