rules-manager
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data to generate and manage rules, which introduces a surface for indirect prompt injection if external contributors control the project files being read.
- Ingestion points: The skill reads project context from
package.json(or equivalent) and existing content fromAGENTS.mdand files within the.agents/rules/directory. - Boundary markers: The skill explicitly instructs the agent to ask the user for confirmation before overwriting files (
initworkflow) and to show a diff for approval before applying clean-up changes (optimizeworkflow). - Capability inventory: The skill performs filesystem writes to
AGENTS.mdand the.agents/rules/directory but does not perform network operations or execute arbitrary system commands. - Sanitization: There is no explicit sanitization or escaping of content read from the project files; however, the output is restricted to documentation files, and the agent is instructed to verify content with the user.
Audit Metadata