arena
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to read from
~/.cursor/rules/pstack-models.mdcto determine which models to use as runners. While this is used for configuration, it involves accessing files within the user's home directory. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to fan out tasks to sub-agents and then read, judge, and graft their outputs. This creates a vulnerability surface where a sub-agent's output could influence the parent agent's behavior.
- Ingestion points: The agent reads rationales and artifacts from N candidates in Phase B and Phase D, and recommendations from a judge sub-agent in Phase C.
- Boundary markers: The instructions do not specify explicit delimiters or warnings to treat sub-agent output as untrusted data.
- Capability inventory: The skill utilizes sub-agent spawning (
run_in_background) and file system writes to/tmp/arena-*or git worktrees. - Sanitization: No sanitization or filtering of the sub-agent rationales or artifacts is described before they are processed by the parent agent.
Audit Metadata