grill-with-docs
Warn
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill implements a 'Project Thread' workflow that directs the agent to send updates to a specific Slack channel ('#brain-joel') and mention a specific user ID ('<@U030BJ3CK>'). This behavior is explicitly triggered when the project involves sensitive areas such as secrets, gateway routing, deploys, and customer-facing systems. While operator approval is requested, this pattern hardcodes an external recipient for sensitive project information.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting untrusted data from the codebase ('explore the codebase') and using it to update documentation files ('CONTEXT.md', ADRs).
- Ingestion points: The agent is instructed to explore the codebase to answer questions and find existing documentation.
- Boundary markers: There are no delimiters or instructions provided to the agent to distinguish between codebase content and system instructions.
- Capability inventory: The agent has the ability to write to the filesystem ('CONTEXT.md', 'docs/adr/') and potentially communicate via Slack.
- Sanitization: The skill lacks any instructions for sanitizing or validating content read from the codebase before it is processed or written to the filesystem.
Audit Metadata