need-explorer

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted user input and incorporates it into system commands.
  • Ingestion points: User answers to exploratory questions regarding problem statements, scope, and success criteria (SKILL.md).
  • Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore malicious instructions embedded within user responses.
  • Capability inventory: The skill instructs the agent to execute shell commands using the ssf tool to record state (SKILL.md).
  • Sanitization: Absent. User-supplied content from the <one-line summary> is interpolated directly into the arguments of the ssf state set command without escaping or validation.
  • [COMMAND_EXECUTION]: The skill utilizes a domain-specific command-line tool to manage workflow state.
  • Evidence: Section 6 (DP-1: Requirement Confirmation Gate) provides shell commands for the agent to execute: ssf state set <change-dir> dp_1_result "confirmed: <one-line summary>" and ssf state set <change-dir> dp_1_timestamp $(date -u +%Y-%m-%dT%H:%M:%SZ).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:26 PM
Security Audit — agent-trust-hub — need-explorer