conducta
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process and coordinate data from external and potentially untrusted sources, creating an attack surface for indirect prompt injection.
- Ingestion points: The skill reads data from work items stored in
~/dev/ledger/itemsand fetches external content from GitHub usinggh pr view. - Boundary markers: There are no instructions defining explicit delimiters (like XML tags or triple backticks) to separate untrusted data (e.g., PR descriptions, worker reports) from agent instructions.
- Capability inventory: The skill has the authority to dispatch background workers (
computa), verify code commits, read filesystem items usingrg, and interact with GitHub PRs. - Sanitization: The instructions do not describe any mechanisms to sanitize, escape, or validate the content of external reports or PR metadata before processing them.
Audit Metadata