ai-proxy-discipline
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to run
npx skills add FuDesign2008/open-skillsto install a required dependency (intake-interview-discipline) if it is missing. - [EXTERNAL_DOWNLOADS]: The skill references and provides instructions for downloading a dependency from the author's public GitHub repository (
FuDesign2008/open-skills) using the standardnpx skillscommand. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and review external artifacts (project cards, plans, reports, and code diffs), which represents an attack surface for indirect prompt injection.
- Ingestion points: External artifacts are provided to the agent as input during the counterpart prompt (e.g.,
<card / plan / completion report / diff>). - Boundary markers: The skill employs a 'blindness principle' (Category 8 mitigation), explicitly instructing the agent to use fresh context per checkpoint and only look at artifact inputs, disregarding execution transcripts.
- Capability inventory: The proxy is restricted to low-impact tasks such as answering intake questions, picking pre-approved options, and issuing quality verdicts. It is explicitly forbidden from performing irreversible actions, merges, or budget extensions.
- Sanitization: The skill enforces a 'Challenge-not-please' mandate and requires evidence-tagged verdicts (
[FACT],[INFERENCE],[UNRESOLVED]) which forces the model to justify its conclusions based on artifacts rather than blindly following instructions.
Audit Metadata