ws
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local project files, which acts as a potential surface for indirect prompt injection.
- Ingestion points: The skill reads state and configuration data from
.lev/pm/workstreams/*/state/workstream.yaml,.lev/pm/tasks/, and.lev/pm/handoffs/. - Boundary markers: No specific delimiters or boundary instructions are provided to ensure the agent ignores instructions potentially embedded within these external files.
- Capability inventory: The agent is authorized to use CLI adapters to perform write operations and reconcile project artifacts based on the ingested state.
- Sanitization: There is no evidence of sanitization or strict schema validation for the data read from the file system before it is used to influence agent behavior.
Audit Metadata