best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts and interpolates them directly into subagent tasks (e.g.,
Task task-intent-analyzer(\"[user's prompt]\")) without using boundary markers or delimiters. This creates a surface for indirect prompt injection where a malicious prompt could attempt to influence the subagents' behavior.\n - Ingestion points:
SKILL.mdaccepts raw user input for transformation.\n - Boundary markers: Absent; user input is directly interpolated into instructions for the subagents.\n
- Capability inventory: The skill uses the
Tasktool to invoke subagents inagents/that possessGlob,Grep, andReadcapabilities to explore the local codebase and search reference documentation.\n - Sanitization: No escaping, filtering, or validation is performed on the
[user's prompt]before it is passed to the sub-tasks.
Audit Metadata