aif-evolve
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from patch files to derive new rules for other skills. A malicious patch could contain instructions disguised as 'prevention points' which the agent might then incorporate into skill context files. The skill also contains a directive (Step 0.2) forcing the agent to comply with these project-specific rules even if they conflict with its own defaults, which strengthens the impact of any injected instructions.
- Ingestion points: Reads files from the patches directory (defaulting to .ai-factory/patches/.md) and existing context files (.ai-factory/skill-context//SKILL.md).
- Boundary markers: None mentioned for the contents of ingested patches to prevent the execution of embedded instructions.
- Capability inventory: The skill uses 'Write' and 'Edit' tools to modify instruction files in .ai-factory/skill-context//SKILL.md and skills//SKILL.md.
- Sanitization: Absent; the skill relies on LLM analysis to extract information from external text without specific validation or filtering.
Audit Metadata