hrt-mr-brief
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external files such as
tasks.md,specs/,design.md, and test outputs. While this creates a surface for indirect prompt injection if those files were to contain malicious instructions, the skill implements several defensive measures. - Ingestion points: The agent reads from
tasks.md,specs/**/*.md,design.md,align.md, working tree diffs, and test output logs. - Boundary markers: The skill does not use specific structural delimiters but operates within a strictly defined template-based output format.
- Capability inventory: The skill is only permitted to write a local markdown file (
mr-brief.md). It is explicitly forbidden from performing network operations, executing git commands (commit,push), or interacting with external review systems. - Sanitization: The skill includes explicit rules to mask or remove sensitive data such as tokens, keys, and personal information (Rule 3). It also prevents the generation of text that could be interpreted as issue tracker commands or CI/CD triggers (Rules 4 and 5).
- [SAFE]: The skill follows the principle of least privilege by restricting its operations to local file reads and a single local file write. The absence of network access and command execution capabilities makes the identified injection surface non-exploitable for high-severity attacks.
Audit Metadata