recall
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from diverse external and potentially untrusted sources, creating an attack surface for indirect prompt injection.
- Ingestion points: The skill instructions direct the agent to read from chat transcripts via a history recipe and sweep shared records including source control, issue trackers, public chat/issue channels, documentation, and error tracking systems (SKILL.md, steps 3 and 4).
- Boundary markers: The skill does not explicitly define delimiters for untrusted data or provide instructions to ignore embedded commands within the ingested text.
- Capability inventory: The skill has the ability to spawn subagents with full access and executes command-line tools such as git and gh to verify state (SKILL.md, steps 3 and 5).
- Sanitization: While the skill mentions sanitizing private context for privacy reasons before output, it lacks specific sanitization or escaping of the ingested content to prevent the agent from following instructions embedded in logs or external reports.
Audit Metadata