critic-dialogue
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary text from external documents (implementation plans, PRs, design docs), which presents a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context via the
{path}variable inSKILL.md, the{document path}inchunker.md, and the{list of original plan file paths}inreviser.md. - Boundary markers: The skill uses structured markdown headers (e.g.,
### Your scope — review this) to isolate the review target, but does not provide explicit instructions for the model to ignore or treat instructions inside the ingested text as data rather than commands. - Capability inventory: The skill includes file-read capabilities across all stages and file-write capabilities in the
reviser.mdstage to apply changes to project files. - Sanitization: There is no evidence of sanitization, filtering, or validation of the ingested content before it is processed by the critic or dev-response subagents.
Audit Metadata