exploitability-validation
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains phrases such as "ignore previous instructions" specifically within the context of a defense mechanism called an "Untrusted-content envelope." These instructions tell the agent to disregard any injection attempts found within the untrusted target source code it is analyzing (e.g., in SKILL.md, stage-a-oneshot.md, stage-b-process.md).
- [DYNAMIC_EXECUTION]: The skill compiles and executes proof-of-concept code to validate vulnerabilities. This is its primary function and is performed using a dedicated sandbox tool (
raptor-run-sandboxed) that enforces network isolation and restricted filesystem writes, preventing unauthorized side effects (e.g., in stage-a-oneshot.md, stage-e-feasibility.md). - [INDIRECT_PROMPT_INJECTION]: The skill manages the risk of processing untrusted data by defining clear boundaries and sanitization rules.
- Ingestion points: Target source code, repository snippets, and external tool outputs (SKILL.md, stage-a-oneshot.md, stage-c-sanity.md).
- Boundary markers: Explicit "Untrusted-content envelopes" instructions (SKILL.md) advise the agent to treat data as non-instructional even if it appears to be an instruction.
- Capability inventory: Execution of shell commands, Python snippets, and compilers via the
libexec/interface (stage-a-oneshot.md). - Sanitization: All code execution is mandatorily performed via
raptor-run-sandboxed, providing environment isolation and preventing network-based data exfiltration.
Audit Metadata