need-explorer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted user input and incorporates it into system commands.
- Ingestion points: User answers to exploratory questions regarding problem statements, scope, and success criteria (SKILL.md).
- Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore malicious instructions embedded within user responses.
- Capability inventory: The skill instructs the agent to execute shell commands using the
ssftool to record state (SKILL.md). - Sanitization: Absent. User-supplied content from the
<one-line summary>is interpolated directly into the arguments of thessf state setcommand without escaping or validation. - [COMMAND_EXECUTION]: The skill utilizes a domain-specific command-line tool to manage workflow state.
- Evidence: Section 6 (DP-1: Requirement Confirmation Gate) provides shell commands for the agent to execute:
ssf state set <change-dir> dp_1_result "confirmed: <one-line summary>"andssf state set <change-dir> dp_1_timestamp $(date -u +%Y-%m-%dT%H:%M:%SZ).
Audit Metadata