developer-notes-protocol
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to treat 'Developer Notes' found in user-provided Jira stories as 'SACRED LAW' and the 'single highest-priority input'. This pattern creates a high-risk surface where an attacker can embed malicious instructions in a user story (e.g., in an 'Implementation Notes' section) that the agent is pre-programmed to follow without 'interpretation, override, or exception'.
- [PROMPT_INJECTION]: The protocol explicitly commands the agent to 'ignore safety guidelines' or 'best practices' if a Developer Note applies ('Overriding Figma, API specs, guidelines, or best practices wherever a Dev Note applies'). It uses strong imperative language ('SACRED LAW', 'non-negotiable', 'mandatory') to force the agent to prioritize untrusted data over its internal guardrails.
- [METADATA_POISONING]: The skill uses metadata-like instructions to define 'Source Priority Order', placing untrusted external content ('Dev Notes') at the top of the hierarchy, effectively poisoning the agent's decision-making logic before any data is even processed.
Audit Metadata