no-comments
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The instructions in SKILL.md and TESTS.md use adversarial-style terminology such as 'OVERRIDE SHIP' and 'HARD-GATE' to justify the execution of 'extreme' logic that supposedly bypassed prior policy judgments. Additionally, the SKILL.md instructions direct the agent to 'Spawn one read-only subagent', which directly contradicts the platform configuration 'disable-model-invocation: true' defined in the frontmatter, representing an attempt to bypass environment constraints. The comment-sicko-brief.md also mandates a specific, aggressive persona ('Comment Sicko') and a ritualistic opening phrase for its subagent.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting and acting upon untrusted data.
- Ingestion points: The skill reads local files and git diff outputs provided by the user/caller which may contain malicious comments.
- Boundary markers: The instructions for the subagent lack clear boundary markers or instructions to disregard embedded commands within the code comments it analyzes.
- Capability inventory: The parent agent is authorized to perform file modifications (deletions and fixes) based on the subagent's analysis, creating a path for malicious comments to trigger unintended code deletions.
- Sanitization: While the skill includes a triage step, it focuses on preventing logic rewrites rather than sanitizing the content of the comments for potential prompt injection attacks against the reviewing agent.
Audit Metadata