devils-advocate

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted user input (plans, targets, or file content) which creates a surface for indirect prompt injection. A malicious plan could contain instructions to divert the agent or abuse available tools. \n
  • Ingestion points: The $ARGUMENTS variable and content from files identified in arguments in SKILL.md.\n
  • Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore instructions within the plan content.\n
  • Capability inventory: The skill dispatches to sub-agents and uses tools for research, exploration, and work-item tracking (e.g., /discovery:research, /discovery:explore, /work-items:track).\n
  • Sanitization: None.\n- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection to execute shell commands when the skill is loaded.\n
  • Evidence: The skill executes git branch --show-current and git log --oneline -5 in SKILL.md to establish context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 07:55 PM
Security Audit — agent-trust-hub — devils-advocate