doubt-driven-development
Warn
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides explicit instructions and shell command examples in
SKILL.mdfor the agent to invoke external binaries. Examples includewhich gemini,gemini --version, and complex piping commands like `codex exec --sandbox read-only -C - < /tmp/doubt-prompt.md`. These patterns guide the agent to perform arbitrary shell execution.
- [DATA_EXFILTRATION]: The 'Cross-model escalation' workflow encourages the agent to extract code snippets (defined as 'artifacts') and transmit them to external services via CLI tools. This behavior represents a data exposure risk where sensitive workspace content is sent outside the immediate environment.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It instructs the agent to ingest external, potentially untrusted code ('artifacts') and pass them to a sub-agent or external LLM (Step 3: DOUBT).
- Ingestion points:
SKILL.md(specifically Step 2: EXTRACT and Step 3: DOUBT). - Boundary markers: The skill uses
ARTIFACT:andCONTRACT:as delimiters, which provide some separation but do not prevent adversarial instructions within the artifact from influencing the reviewer. - Capability inventory: The skill utilizes shell execution and external API communication via CLI tools.
- Sanitization: The instructions focus on preventing shell injection (via stdin piping) but do not describe methods to sanitize the artifact content against LLM-based instruction injection.
Audit Metadata