root-cause
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data which constitutes a vulnerability surface.
- Ingestion points: The skill processes 'error messages', 'stack traces', 'event logs', 'DOM/console/network' outputs, and 'audit-traces' as described in Phase 1 and Phase 2 (SKILL.md).
- Boundary markers: There are no explicit instructions to use delimiters or warnings for the agent to ignore instructions embedded within these external logs or traces.
- Capability inventory: The skill has significant capabilities, including executing shell commands (curl, git, test runners), file system modifications (Phase 4 fix), and network research via sub-skills.
- Sanitization: There is no mention of sanitizing or escaping the external content before the agent processes it. An attacker could potentially embed malicious instructions in a log file or web page that the agent is then instructed to 'read' and 'analyze'.
Audit Metadata