ensemble-rule-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The ensemble-rule-review pattern is designed to process untrusted external data (defined in
{{INPUT_SCOPE}}withinassets/worker-prompt-skeleton.md) using multiple parallel agents. This creates a surface for indirect prompt injection where instructions embedded in the analyzed data could attempt to influence agent behavior. - Ingestion points: Untrusted data is ingested into the context of worker agents via the
INPUT_SCOPEparameter in the worker prompts as seen inassets/worker-prompt-skeleton.md. - Boundary markers: The worker prompt template in
assets/worker-prompt-skeleton.mduses distinct markdown headers to separate instructions from the input data, providing a structural boundary. - Capability inventory: As noted in
SKILL.md, the recommended worker agents (focused-reviewer) are grantedRead,Grep,Glob,Bash, andWritetools, which represents a high-capability surface if an injection were to bypass safety filters. - Sanitization: The skill relies on prose-based mitigations, such as 'instruction hygiene' (detailed in
references/instruction-hygiene.md) and rigid worker roles ('NO creativity'), rather than programmatic sanitization or content filtering.
Audit Metadata