fix
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process that ingests untrusted data from external sources (error reports, logs, and artifacts) to reproduce bugs.\n
- Ingestion points: Step 1 (Define the symptom) and Step 2 (Build the tightest feedback loop) involve reading error text, artifact content, and user reports verbatim into the agent's context.\n
- Boundary markers: The skill references internal security policies ("Secrets and Confidential files rules") but does not specify technical delimiters to separate untrusted data from instructions.\n
- Capability inventory: The skill allows for local script execution (
.agents/tools/plan-refresh.sh), file system writes (temporary logs and harnesses), and the creation of regression tests.\n - Sanitization: The instructions do not mandate specific sanitization or escaping of the ingested error artifacts.\n- [COMMAND_EXECUTION]: The skill instructs the agent to run local automation scripts as part of its workflow.\n
- Evidence: The agent is told to "Refresh the printout with
.agents/tools/plan-refresh.sh" to stay synchronized with the project status.\n - Evidence: The workflow involves executing tests, command scripts, and browser automation to verify symptoms and fixes.
Audit Metadata