ultra
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary task descriptions provided via user arguments (
$ARGUMENTS) and interpolates them directly into the prompts for several specialized agents (Planner, Implementer, Decision, and Reviewer). - Ingestion points: The
TASKvariable inworkflow.jsis sourced fromargs.task, which originates from the user's command-line input. - Boundary markers: The skill utilizes Markdown headers (e.g.,
## Task,## Acceptance criteria) to separate data fields, but it does not include explicit instructions for the models to disregard or sanitize potential prompt injection attempts embedded within the user's task text. - Capability inventory: The agents in this workflow are granted the ability to read and modify files throughout the repository and execute shell commands defined in the
verifyCommandfield (e.g.,npm test). - Sanitization: No validation or sanitization logic is present to filter or escape malicious instructions before the input is passed to the LLM agents.
Audit Metadata