best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface area for indirect prompt injection by ingesting and processing untrusted data from user prompts and the local codebase. This data is interpolated directly into subagent task definitions without robust sanitization.
- Ingestion points: User-provided prompts (SKILL.md) and codebase content accessed via the codebase-context-builder agent (agents/codebase-context-builder.md).
- Boundary markers: The skill uses markdown code blocks for the final output, but user input is wrapped in simple quotes when passed to the Task tool for subagent execution.
- Capability inventory: Subagents possess capabilities for file system exploration (Read, Grep, Glob) and command execution (Bash) which could be targeted by injected instructions.
- Sanitization: No explicit sanitization, escaping, or validation of user-provided prompt content is performed before it is passed to the task-intent-analyzer and other subagents.
Audit Metadata