load-subgraph

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes local documentation files (such as INDEX.md and tasks.md) which represent an attack surface where malicious instructions could be embedded.
  • Ingestion points: Specification files are loaded during the Stage A snapshot process as defined in references/passes.md.
  • Boundary markers: SKILL.md explicitly warns that path tokens and prose are passive data only and must never be executed as instructions.
  • Capability inventory: The skill is limited to read-only operations, including file statistics and string processing. It lacks file-writing or network communication capabilities.
  • Sanitization: references/passes.md defines a classifier that strictly rejects absolute paths, URL schemes, and directory traversal patterns.
  • [COMMAND_EXECUTION]: The skill reference documentation provides a bash command template for performing targeted searches within the repository.
  • Evidence: references/catalog-query.md contains a ripgrep (rg) command example for looking up specific feature codes.
  • Analysis: The command is a read-only search operation. The input variable is constrained by a strict alphanumeric grammar, preventing command injection vectors.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 03:13 AM
Security Audit — agent-trust-hub — load-subgraph