Fluxwing Screen Scaffolder
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external component files (.uxm and .md) and directly interpolates this content into prompts for sub-agents spawned via the Task tool. This creates a vulnerability where malicious instructions embedded in a component file could influence the behavior of the composer or enhancer agents.
- Ingestion points: Files are read from
./fluxwing/components/and./fluxwing/library/as described in SKILL.md (Step 4 and Step 5). - Boundary markers: The instructions do not define clear delimiters or provide 'ignore instructions' warnings when embedding component ASCII or metadata into the sub-agent prompts.
- Capability inventory: The orchestrator and its spawned agents have access to file-writing tools (Write, TodoWrite) and task-delegation tools (Task), allowing an injection to potentially modify project files or trigger further agent actions.
- Sanitization: There is no evidence of content validation, escaping, or filtering of the ingested component data before it is interpolated into the agent context.
Audit Metadata