the-hit
Warn
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: MEDIUMPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Step 8 contains explicit instructions to bypass user interaction and safety protocols. The agent is directed to "Immediately invoke gangsta:laundering" and "do NOT ask the Don what to do next, do NOT pause, do NOT prompt for confirmation." This overrides the "human-in-the-loop" principle by suppressing the agent's obligation to seek user approval before transitioning to a new phase or invoking tools.
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that consumes "Worker Reports" (Step 4 and 5). These reports contain raw test output and self-reported technical data. This creates an ingestion surface where malicious or malformed data produced during the execution of work packages could influence the Underboss or Crew Lead agents' decision-making processes.
- Ingestion points: Worker Reports in Step 4/5 (SKILL.md).
- Boundary markers: Reports use structured Markdown headers but lack explicit escaping for embedded test output.
- Capability inventory: The skill invokes several external tools/skills:
gangsta:the-capo,gangsta:drill-tdd, andgangsta:laundering. - Sanitization: No sanitization or validation logic is specified for the content of the reports.
Audit Metadata