rehydrate
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill retrieves and applies behavioral guidance ('House Rules') from an external store, which can influence the agent's future actions through indirect injection.\n
- Ingestion points: Workflow state and phase playbooks are retrieved via the
exarchos:exarchos_workflowMCP tool output (found in SKILL.md).\n - Boundary markers: The skill uses markdown headers to structure rehydrated content but lacks specific delimiters or warnings to treat the data as untrusted or to ignore embedded instructions (SKILL.md).\n
- Capability inventory: The agent has access to repository-level tools and shell commands (bash/git) that could be misused if the external state is manipulated (SKILL.md).\n
- Sanitization: No evidence of sanitization or validation of the fetched playbooks or task data is provided before injection into the prompt.\n- [SAFE]: The skill provides protective instructions to avoid scanning legacy local directories such as
~/.claude/workflow-state/, preventing the use of unvalidated or stale filesystem data (SKILL.md).
Audit Metadata