readback
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions create a surface for indirect prompt injection by directing the agent to interpret commands based on external file content.
- Ingestion points: In SKILL.md, the agent is instructed to check its restatement against "files on disk", "project memory", and "session history" to resolve ambiguities.
- Boundary markers: There are no instructions to use delimiters or ignore embedded instructions within the files being read, which allows malicious data in files to influence the agent's interpretation.
- Capability inventory: The agent is authorized to perform "substantial work" and write interpretations to plan files, commit messages, and pull request bodies, providing an execution path for injected instructions.
- Sanitization: The workflow lacks any requirement for sanitizing or validating context data before it is used to resolve forks in interpretation.
Audit Metadata