hillclimb
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill process relies on the execution of an 'evidence command' defined in a local
PLAN.mdfile. This command is run each round to produce the outputs (screenshots, recordings, or text) that the evaluators will grade. The security of this operation depends on the commands specified in the plan file. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface where LLM evaluators process data generated from an artifact being improved, which could contain malicious instructions.
- Ingestion points: Evaluators ingest evidence generated by the 'evidence command' (outputs, rendered pages, or sample results) in
SKILL.md(Step 2. The panel). - Boundary markers: The skill advises stripping author commentary to maintain objectivity, but does not specify boundary markers or instructions to ignore embedded commands within the artifact evidence itself.
- Capability inventory: The skill environment supports shell command execution, spawning of multiple subagents (evaluators using models like
fableoropus), and file system operations within thehillclimb/directory. - Sanitization: No explicit sanitization or filtering of the artifact's output is defined before it is presented to the evaluator panel.
Audit Metadata