clarify-decisions
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is highly dependent on user input to navigate a complex decision tree and recompute the 'open set' of questions. This input is processed without explicit sanitization or boundary markers, creating an attack surface where a user could potentially steer the agent's logic through embedded instructions.
- Ingestion points: The skill explicitly mandates that 'EVERY QUESTION IS INLINE CHAT' and the agent must 'recompute the open set after every answer' (SKILL.md).
- Boundary markers: There are no requirements in the instructions to wrap user responses in delimiters or to ignore instructions within the data.
- Capability inventory: The agent has the capability to read project metadata files (Knowns, scan digests) and invoke sub-skills like
load-subgraphandassess-observability(SKILL.md). - Sanitization: No sanitization or validation of user-provided content is described in the protocol.
- [NO_CODE]: The skill consists entirely of markdown instructions, evaluation data, and configuration metadata. It does not include or execute any script files such as Python, JavaScript, or Shell scripts.
Audit Metadata