context-drift
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill audits content from several repository files, creating a surface for indirect prompt injection where malicious instructions embedded in documentation could attempt to influence the agent's behavior. This is moderated by a staged workflow and a strict requirement for human approval of diffs.
- Ingestion points: AGENTS.md, CLAUDE.md, ARCHITECTURE.md, CONSTRAINTS.md, JARGON.md, EPISTEMIC-MAP.md, README.md, and openspec/config.yaml as specified in SKILL.md (Stage 1).
- Boundary markers: The skill employs a multi-stage process (Stages 1-8) to separate data reading from action, utilizing subagents for specialized tasks.
- Capability inventory: Performs file reads, invokes subagents for review and application phases, and generates file-write proposals (SKILL.md, Stages 2, 7).
- Sanitization: No explicit sanitization or filtering of file content is described; however, the skill enforces a mandatory human review gate in Stage 6, requiring explicit user acceptance of diff previews before any edits are applied.
Audit Metadata