create-postmortem

Pass

Audited by Gen Agent Trust Hub on Mar 18, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes data from user-provided arguments and existing incident reports in the '.chalk/docs/engineering/' directory, creating a surface for indirect prompt injection. Malicious instructions embedded in these reports could potentially influence the agent's behavior during the postmortem generation process. * Ingestion points: $ARGUMENTS and incident report files. * Boundary markers: Absent; no specific delimiters or instructions are used to distinguish untrusted content from the agent's primary instructions. * Capability inventory: The agent utilizes Read, Glob, Grep, and Write tools to manage engineering documentation. * Sanitization: The skill implements role-based name redaction to maintain blamelessness but does not filter for potential prompt injection patterns or instructions within the input data.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 18, 2026, 08:10 AM
Security Audit — agent-trust-hub — create-postmortem