batch
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the flow of potentially untrusted data from user arguments and existing codebase content into the prompts of worker subagents.
- Ingestion points: Data enters the system via the $ARGUMENTS variable and the research results gathered by subagents during the plan phase.
- Boundary markers: The prompt template for worker subagents does not utilize delimiters or explicit instructions to isolate untrusted data, increasing the risk of the subagent interpreting data as new instructions.
- Capability inventory: The worker subagents are empowered to modify the codebase, execute shell commands (via tests), and perform git operations including PR creation.
- Sanitization: The skill lacks any explicit validation or sanitization of the research data or user input before it is passed to the autonomous workers.
Audit Metadata