architecture
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to use 'explorer' subagents to grep and search the repository to understand existing patterns and primitives. This ingestion of untrusted code from the repository represents a surface for indirect prompt injection, as malicious instructions hidden in the codebase could influence the agent's architectural recommendations or implementation steps.
- Ingestion points: Repository files and folder structures accessed via the 'explorer' Task (SKILL.md).
- Boundary markers: The skill lacks explicit instructions for the agent to distinguish between data being analyzed and the instructions guiding the analysis.
- Capability inventory: The skill is authorized to draft 'Structure' cards, recommend behavior-preserving moves, and create new folders or files (SKILL.md, doctrine.md).
- Sanitization: There are no explicit instructions to sanitize or escape content read from the repository before it is processed by the agent or subagents.
Audit Metadata