frame-change
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple local sources which could potentially contain malicious instructions if a repository is compromised or contains adversarial documentation.
- Ingestion points: Reads
CONTEXT.md,docs/specs/INDEX.md,docs/agents/project.md, and uses a 'scan subagent' to read code and docs near the proposed feature. - Boundary markers: None explicitly defined for the files being read to distinguish between system instructions and file content.
- Capability inventory: The skill has access to
run-spike(for executing code),research(likely network access for library documentation), andplan-milestones(file system writes to roadmap files). - Sanitization: No specific sanitization or escaping of the ingested project data is mentioned before processing.
Audit Metadata