maintain-formal-verification-skill
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to ingest and analyze untrusted external data, specifically project code diffs and commit messages, to determine necessary updates for formal verification.
- Ingestion points: Git commit messages and code changes are read into the agent's context as specified in the 'Pass' section (Step 3) of
SKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the ingested data to prevent it from being interpreted as agent commands.
- Capability inventory: The skill enables the agent to execute shell commands for running verification tools and to perform file-write operations to update verification models and harnesses (found in
SKILL.md). - Sanitization: No explicit sanitization, validation, or escaping of the input commit messages or code comments is mandated by the skill instructions.
Audit Metadata