dogfood-tester
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's operational workflow requires the agent to read and follow external data that is outside its control, creating an attack surface for malicious instructions.
- Ingestion points: In
SKILL.md, Phase 1 and Phase 3 explicitly instruct the agent to read surface materials like READMEs, manifests, and documentation from the target product being tested. - Boundary markers: The instructions do not specify the use of delimiters, block quotes, or "ignore embedded instructions" warnings when processing the contents of external READMEs or documentation.
- Capability inventory: The skill encourages the agent to perform installation tasks and execute commands (
scripts/testing-heuristics.md) based on the content of the external documentation. - Sanitization: There is no mention of sanitizing, escaping, or validating instructions retrieved from third-party sources before the agent incorporates them into its execution path.
Audit Metadata