judge
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted content ('artifacts') generated by other subagents, creating a surface for indirect prompt injection. Maliciously crafted artifacts could contain instructions aimed at manipulating the judge's behavior, inflating scores, or bypassing the 'iron rules' dimension.\n
- Ingestion Points: Stage 2 of the skill reads subagent outputs and artifacts into the evaluation context.\n
- Boundary Markers: The instructions do not define specific delimiters or instructions to the LLM to ignore embedded commands within the artifacts.\n
- Capability Inventory: The skill utilizes agent spawning via the Task tool and maintains state through filesystem operations in the .shannon/ and reports/ directories.\n
- Sanitization: No sanitization or validation of the input artifacts is specified before they are processed by the judge agent.\n- [COMMAND_EXECUTION]: The workflow relies on a two-stage process where a 'meta-judge' generates a YAML rubric that is written verbatim to the filesystem and subsequently parsed by the judge. This pattern introduces a potential risk of schema confusion or unsafe deserialization if the generation stage is influenced by adversarial input, although this is a systemic risk rather than a direct exploit.
Audit Metadata