northstar-refresh
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data provided by the operator to define the project or refresh scope, which serves as a potential surface for instructions embedded in that data.
- Ingestion points: Text provided after the
/northstar-refreshcommand as specified inSKILL.md. - Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings to isolate the scope text from the core instructions.
- Capability inventory: The skill's capabilities are limited to reading local markdown files and writing capture notes to
docs/triage/. It explicitly prohibits high-risk operations such as network access, starting workers, creating worktrees, or merging code. - Sanitization: The skill lacks explicit instructions for sanitizing, escaping, or validating the input text before the agent processes it.
Audit Metadata