figure-it-out
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to create or open checklist files at paths derived from external variables:
~/.local/state/pstack/checklists/<repo>-<branch>.md. This represents an indirect prompt injection surface if the repository or branch names are sourced from untrusted inputs. - Ingestion points: The
<repo>and<branch>variables are used to construct the state file path inSKILL.md. - Boundary markers: No specific boundary markers or validation instructions are provided to sanitize these variables.
- Capability inventory: The agent uses file read/write capabilities to manage these checklist files and follows instructions contained within referenced local skill files (
../<name>/SKILL.md). - Sanitization: The instructions do not explicitly mandate sanitization of the repository or branch strings, potentially allowing for path traversal or state file manipulation if the harness does not enforce strict path constraints.
Audit Metadata