work-the-problem
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a strict read-only boundary for the user's project. It includes explicit 'Iron Laws' that prohibit writing to tracked project state, enacting decisions, or committing code (e.g., 'NEVER WRITE TRACKED PROJECT STATE; NEVER ENACT THE DECISION').
- [SAFE]: Data persistence is scoped to a local session directory (
.skills/work-the-problem/). The skill includes anti-pattern warnings specifically forbidding the storage of secrets or tokens in these artifacts, reducing the risk of credential exposure. - [SAFE]: The skill enforces human-in-the-loop execution for sub-tools. Rather than auto-invoking potentially dangerous tools, it is instructed to name the tool (e.g.,
/run-spike,/forge-prompt) for the user to run manually. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface as it ingests untrusted data from the local repository and the
researchsub-skill. - Ingestion points: Reads repository files (
Actphase) and external data via theresearchsub-skill. - Boundary markers: Uses a mandatory structured 'Announce' block and 'claim hygiene' labels (Source, Verified, Inference, Open) to separate external claims from agent reasoning.
- Capability inventory: Limited to writing local markdown artifacts in a hidden directory; no direct command execution or network exfiltration capabilities are present in the skill's own instructions.
- Sanitization: Relies on explicit verification steps and a requirement for the user to confirm leaf closures ('USER ARTICULATES OR CONFIRMS BEFORE A LEAF CLOSES').
Audit Metadata