qstack-loop-no-nonsense
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and 'obeys exactly' instructions from external, potentially untrusted plan files (e.g.,
plan.html,plan.md). While it includes a 'no-nonsense' policy to ask for clarification, an attacker-controlled plan could contain instructions designed to influence the agent's behavior during the implementation phase. - Ingestion points: The agent reads plan files from
qstack/compound_engineering/plans/*/plan.htmland other repository paths. - Boundary markers: The skill instructions attempt to set a boundary by stating 'Treat the plan as the contract' and 'Do not expand scope', but lacks explicit delimiters for the plan content itself.
- Capability inventory: The agent has the capability to run validation commands, execute repository tests/linters, and orchestrate 'fresh independent agents' for reviews.
- Sanitization: No explicit sanitization or filtering of the plan content is described before the agent 'obeys' it.
- [COMMAND_EXECUTION]: The skill instructions require running repository validation commands, tests, linters, and type checks. This is a standard capability for engineering agents and is scoped to the repository's own tools.
- [REMOTE_CODE_EXECUTION]: The skill orchestrates 'fresh independent agents' to perform reviews. While this involves launching external processes/agents, it is an intended architectural feature for adversarial review rather than an unauthorized remote code execution vulnerability.
Audit Metadata