best-of-n
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data such as "Acceptance criteria", "Task scope", and "Rubrics" to evaluate candidates. This ingestion creates a surface where malicious instructions could be embedded in the task data to influence the agent's selection or bypass safety protocols during the verification phase.
- Ingestion points: Task scope, repository revision, acceptance criteria, and rubric fields defined in the SKILL.md instructions.
- Boundary markers: The protocol uses a "frozen contract" and "proof log" to provide structure, but does not explicitly define sanitization or escape characters for untrusted input data.
- Capability inventory: The procedure requires the agent to "Run the declared executable checks," which typically involves shell command execution or running testing scripts found in the target repository.
- Sanitization: The skill lacks explicit instructions for sanitizing or validating the input data before it is interpreted by the agent or executed as a check.
Audit Metadata