ps-arena
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process output generated by multiple sub-agents ("candidates") which may contain untrusted data.
- Ingestion points: The agent reads the entire content of candidate artifacts stored in paths such as
/tmp/arena-<slug>/candidate-<n>/or git worktrees (SKILL.md, Phase B/C/D). - Boundary markers: The instructions do not specify any delimiters or safety markers to isolate sub-agent output from the parent agent's instructional context.
- Capability inventory: The skill has the capability to delegate tasks to sub-agents, read files, and write synthesized artifacts to the file system.
- Sanitization: No sanitization or validation of the sub-agent output is described before it is read and "grafted" into the final result.
Audit Metadata