matcher
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to treat the repository's AGENTS.md file as the primary authority for project rules and tool configurations. This ingestion of external, untrusted data into the agent's decision-making process is an indirect prompt injection surface.\n
- Ingestion points: Processes AGENTS.md, references/levers.md, source code from src and include, and binary artifacts (symbols, strings).\n
- Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore potentially malicious instructions embedded in the analyzed code or configuration files.\n
- Capability inventory: The skill utilizes shell-based project tools (match, build, rules) and standard command-line utilities (git).\n
- Sanitization: No sanitization or validation protocols are defined for handling identifiers (like function names) extracted from potentially untrusted binary evidence before they are used in logic or commands.\n- [COMMAND_EXECUTION]: The skill workflow involves executing several shell commands and custom project utilities that incorporate variables derived from the analyzed project.\n
- Evidence: Templates such as git log -S'\u003Cfunction-name\u003E' and project-specific verbs like match \u003Cunit\u003E and diff \u003Cfunction\u003E depend on interpolating strings from the target codebase.\n
- Risk: If the agent executes these commands without strict escaping, identifiers extracted from the analyzed codebase could be used to perform command injection.
Audit Metadata