aep-autopilot
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from feature workspaces that are technically external to the main orchestrator session, creating an indirect injection surface.\n
- Ingestion points: The autopilot tick protocol reads
.feature-workspaces/<name>/.dev-workflow/signals/status.jsonandeval-response-*.mdfrom worker worktrees to synchronize progress, cost, and evaluation results (File:SKILL.md,references/tick-protocol.md).\n - Boundary markers: The architecture uses a dedicated 'CHECK' phase that runs in a cheap, context-isolated agent (e.g., a Haiku subagent or Codex one-shot) to parse signals. This prevents potentially malicious content in signal files from influencing the primary orchestrator session (File:
SKILL.md,references/tick-protocol.md).\n - Capability inventory: The orchestrator maintains capabilities to nudge workspace agents, perform git operations, and interact with the GitHub CLI (
gh pr).\n - Sanitization: All state and signal data is validated using a minimal, dependency-free JSON schema validator (
scripts/json-schema.mjs) against a strict schema (references/autopilot-state.schema.json) to prevent schema confusion and malformed data ingestion.
Audit Metadata