principle-subtract-before-you-add
Warn
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill explicitly overrides the agent's standard operating procedures with custom delegation rules, telling the agent to 'Apply these overrides before following the original workflow.'
- [PROMPT_INJECTION]: It instructs the agent to avoid adding 'speculative validators, parsers, or guards' and to remove existing ones. This instruction potentially encourages the creation of insecure software by discouraging defensive programming and input validation.
- [COMMAND_EXECUTION]: The instructions direct the agent to launch 'Codex CLI workers' using specific scripts like 'spawn-codex-worker' or 'direct codex exec,' promoting the use of external tools that may not be verified.
Audit Metadata