qrspi-question
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data such as ticket files, issue descriptions, or task summaries to drive its internal logic and file generation.
- Ingestion points: User-supplied task descriptions, local ticket file paths, or remote issue URLs provided at invocation (SKILL.md).
- Boundary markers: None specified; the agent is instructed to "Read any provided files fully" without explicit delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill utilizes shell commands (
mkdir -p), file-write operations (task.md,questions.md), and invokes a sub-agent (codebase-locator). - Sanitization: There is no explicit sanitization or escaping of the input data before it is incorporated into the prompt or used to generate directory paths.
- Mitigation: The risk is significantly reduced by a mandatory human-in-the-loop checkpoint (Process step 8) requiring user approval or edits before the agent finalizes its output.
Audit Metadata