model-tracking-protocol
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes bash script templates intended for the agent to manage session environments, track execution timing, and maintain local logs. These scripts utilize standard system utilities such as
date,mkdir,head, andxxdto generate session identifiers and record performance metrics. - [INDIRECT_PROMPT_INJECTION]: The protocol requires the agent to ingest and compare findings (reviews) from multiple external AI models to perform consensus analysis. This creates a surface where malicious or adversarial instructions embedded in the outputs of those external models could influence the agent's consolidated report.
- Ingestion points: Markdown review files generated by external models and stored in the
$SESSION_DIRdirectory. - Boundary markers: The templates do not specify the use of delimiters or boundary markers to isolate the untrusted external content during the parsing and comparison phase.
- Capability inventory: The agent performs file system writes and updates a persistent performance log (
ai-docs/llm-performance.json). - Sanitization: The provided examples do not include logic for sanitizing or validating the content extracted from external model responses before it is interpolated into the final consensus summary.
Audit Metadata