verification-loops
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The LLM-as-judge implementation in SKILL.md creates an attack surface for indirect prompt injection where untrusted content could manipulate the evaluation process.\n- Ingestion points: The evaluate method in LLMJudgeGrader takes an output string (untrusted data) and interpolates it directly into a judge prompt.\n- Boundary markers: The prompt template does not use delimiters to isolate untrusted output from instructions.\n- Capability inventory: The grader output influences the agent's control flow (Accept/Reject/Feedback), creating a feedback loop that could be exploited.\n- Sanitization: No escaping or validation is applied to the untrusted output before interpolation.
Audit Metadata