ketchup
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill configuration uses
disable-model-invocation: trueand the instructions explicitly require the agent to remain read-only. No patterns of data exfiltration, command execution, or malicious obfuscation were found. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from chat history and subagent reports, which is a known attack surface for indirect prompt injection. However, the risk is mitigated by the skill's read-only design and the lack of execution capabilities.
- Ingestion points: Processes chat history, subagent messages, and PR/CI statuses as specified in
SKILL.md. - Boundary markers: No specific delimiters are used to separate untrusted data from instructions.
- Capability inventory: The skill is restricted to read-only operations and cannot execute code, start jobs, or invoke models.
- Sanitization: No explicit sanitization or filtering of input data is defined.
Audit Metadata