qstack-how
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of repository code, configuration, and documentation to provide explanations and architectural critiques.
- Ingestion points: The agent is instructed to search for entry points, read implementations, and trace callers/callees across the entire codebase (
SKILL.md,references/exploration.md). - Boundary markers: The instructions do not include explicit delimiters or warnings to ignore instructions that might be embedded within the source code, comments, or configuration files being analyzed.
- Capability inventory: While the skill contains strong negative constraints ("It does not edit files, fix critique findings, commit, push, publish, deploy, or message anyone"), its core function is to influence the agent's output based on external content.
- Sanitization: There is no mention of sanitizing or filtering the content retrieved from the file system before it is processed by the model.
Audit Metadata