arena
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that ingests and processes outputs from multiple parallel 'candidate' models. These outputs represent untrusted data that could contain instructions intended to influence the main agent during the evaluation and grafting phases.
- Ingestion points: Candidate outputs are read in 'SKILL.md' during Phase C (Cross-judge), Phase D (Pick a base), and Phase E (Graft).
- Boundary markers: While the workflow uses a rubric and a cross-judge model, there are no explicit instructions to wrap or delimit candidate content to prevent the execution of embedded instructions.
- Capability inventory: The agent can spawn background processes ('SKILL.md', Phase B) and write to the filesystem via git worktrees or the /tmp directory ('SKILL.md', Phase A).
- Sanitization: The instructions do not specify any sanitization or validation of candidate outputs before they are processed.
- [COMMAND_EXECUTION]: The skill instructs the agent to launch 'external lanes' which are described as 'direct background launcher processes'. This capability is used to parallelize tasks but involves the execution of shell commands.
Audit Metadata