review
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the reviewer's verdict or behavior.\n
- Ingestion points: The skill ingests integrated diffs (via
exarchos_orchestrate), design/spec documents (from the state file), intent grounding directives, and audit-mode invariant prompts.\n - Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags) or 'ignore' prefixes when interpolating these external data sources into the agent's context, making it susceptible to content that attempts to override its adversarial persona.\n
- Capability inventory: The skill can execute project-level shell commands (e.g.,
npm run test), update workflow states (e.g.,transitiontosynthesize), and emit events, providing a path for potential exploitation if an injection succeeds.\n - Sanitization: There are no instructions for validating, escaping, or sanitizing the ingested diff or spec content before it is processed by the agent.
Audit Metadata