zj-leader
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform active research by executing commands within the user's local codebase to verify environment state, tool availability, and baseline metrics such as linting status and test coverage.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from local code repositories (e.g., README files, documentation) and web search results to formulate its task briefs. This ingestion of external content creates a surface area for indirect prompt injection.
- Ingestion points: Local project files (README.md, docs, source code) and results from web search engines (specified in the 'Research' section of SKILL.md).
- Boundary markers: The instructions recommend using a
BLOCKED.mdfile for unresolved issues or unverified assumptions, but they do not define specific prompt delimiters (like XML tags or triple quotes) to wrap ingested content when the agent processes it. - Capability inventory: The agent has the ability to execute shell commands to verify system state and write structured task briefs intended for execution by other agents.
- Sanitization: There are no explicit instructions to sanitize or escape content retrieved from the codebase or the internet before it is incorporated into the task instructions.
Audit Metadata