check-deliverable
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Argument interpolation: User-supplied values for
--tierand--subgroupare placed directly into the instruction block for the sub-agent without explicit validation or sanitization, which could allow for minor instruction overriding if the platform doesn't enforce strict argument enumerations.\n- [DATA_EXFILTRATION]: File access: The skill enables the agent to access and process the contents of arbitrary local files based on a user-provided path, though this is restricted to text-based extensions (.md, .txt, .markdown) which mitigates the risk of harvesting standard system credentials.\n- [COMMAND_EXECUTION]: Sub-agent instructions: The skill directs a sub-agent to perform file-level operations, specifically to "Read and Grep the file directly". While this is not a direct shell execution by the primary agent, it defines a capability surface that relies on the sub-agent's underlying safety when handling file paths.\n- [PROMPT_INJECTION]: Indirect prompt injection risk:\n - Ingestion points: The agent ingests and processes the content of external text files provided by the user (SKILL.md, Step 2).\n
- Boundary markers: The instructions provided to the sub-agent lack explicit boundary markers (e.g., XML tags or triple quotes) or specific directives to ignore instructions embedded within the target file.\n
- Capability inventory: The skill uses the Agent tool to spawn a sub-agent (
qa-reviewer) which is granted file-reading and analysis capabilities (SKILL.md, Step 2).\n - Sanitization: The skill performs file extension validation to restrict processing to text files, but does not sanitize the contents of the file before processing.
Audit Metadata