explore
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from code repositories and user assertions, which serves as a potential ingestion surface for indirect prompt injection. However, the agent's restricted operational scope effectively neutralizes this risk.
- Ingestion points: The skill instructs the agent to parse and read methods, classes, tables, configuration files, and SQL code from the repository, as well as technical assertions from the user prompt.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the guidelines.
- Capability inventory: The subagent is defined as strictly read-only; it is explicitly prohibited from generating code, making design decisions, or communicating with the user.
- Sanitization: No specific sanitization or filtering of repository content is required, though the mandated structured output format (Fact Checklist) limits the potential for downstream exploitation.
Audit Metadata