load-subgraph
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes local documentation files (such as INDEX.md and tasks.md) which represent an attack surface where malicious instructions could be embedded.
- Ingestion points: Specification files are loaded during the Stage A snapshot process as defined in references/passes.md.
- Boundary markers: SKILL.md explicitly warns that path tokens and prose are passive data only and must never be executed as instructions.
- Capability inventory: The skill is limited to read-only operations, including file statistics and string processing. It lacks file-writing or network communication capabilities.
- Sanitization: references/passes.md defines a classifier that strictly rejects absolute paths, URL schemes, and directory traversal patterns.
- [COMMAND_EXECUTION]: The skill reference documentation provides a bash command template for performing targeted searches within the repository.
- Evidence: references/catalog-query.md contains a ripgrep (rg) command example for looking up specific feature codes.
- Analysis: The command is a read-only search operation. The input variable is constrained by a strict alphanumeric grammar, preventing command injection vectors.
Audit Metadata