lead
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and acts upon data from untrusted external sources, creating an attack surface for indirect prompt injection.
- Ingestion points: The skill reads work items from local files located at
~/dev/ledger/itemsand consumes summaries/reports generated by background workers (e.g.,general,verify). - Boundary markers: The instructions lack explicit boundary markers or directives to ignore instructions that might be embedded within the ledger items or worker reports.
- Capability inventory: The skill can dispatch background workers, trigger verification passes on code commits, and read GitHub pull request data using the
ghCLI. - Sanitization: There is no evidence of sanitization, schema validation, or escaping applied to the content ingested from the ledger or worker outputs before it is used to determine the next phase of work.
Audit Metadata