poc
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its automated data gathering and execution pipeline.
- Ingestion points: The
load_prior_artstep explicitly instructs the agent to search external sources, repository documentation, and chat history. These sources can contain malicious instructions embedded by an attacker. - Boundary markers: The skill lacks explicit instructions to treat external data as untrusted or to use delimiters/boundary markers to isolate external content from its own logic.
- Capability inventory: The skill has significant capabilities, including executing shell commands (as noted in the
Proof ProtocolandCommandssections), writing artifacts to the file system (prototypes/logic modules), and performing network operations via tools to 'touch real APIs'. - Sanitization: While the skill mentions 'excluding secrets' from UI variants, it does not specify sanitization or validation of the instructions or data retrieved from external sources before they are used to influence the 'verdict' or 'route'.
Audit Metadata