iterate-prd
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from user feedback and external files within the task directory (such as ticket.md, research papers, and design discussions).
- Ingestion points: Reads all files in the
.humanlayer/tasks/TASKNAMEdirectory and processes direct user input during the iteration loop. - Boundary markers: The instructions do not define specific delimiters for separating user content from instructions, though it does instruct the agent not to accept corrections blindly.
- Capability inventory: The skill can list files (
ls), read files (Read), edit documents (Edit,MultiEdit), and spawn additional research agents (Agent()). - Sanitization: There is no explicit sanitization or filtering mentioned for the content retrieved from external files or user messages.
Audit Metadata