double-check
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes 'finished deliverables' as its primary input to extract claims and requirements for verification. This creates a surface for indirect prompt injection where instructions or malicious commands embedded in the deliverable could influence the agent's behavior during the check.
- Ingestion points: Content from 'finished deliverables' is parsed in the 'Extract claims and requirements' step.
- Boundary markers: There are no explicit delimiters or sanitization steps mentioned to isolate the deliverable's content from the agent's instructions.
- Capability inventory: The skill uses the Agent tool to spawn sub-checkers with the ability to read files and execute shell commands ('commands re-run').
- Sanitization: The skill relies on a prompt-based instruction ('READ-ONLY' for checkers) to restrict sub-agents, which is an insufficient security boundary against malicious content.
- [COMMAND_EXECUTION]: The verification procedure requires re-running commands specified in the deliverable to confirm assertions. This directly executes code provided in the untrusted input deliverable, potentially leading to unauthorized operations if the commands are malicious.
Audit Metadata