fable-opus
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input and session context to brief subagents, creating a surface for potential indirect instructions. \n
- Ingestion points: SKILL.md: Step 2 instructions pass "the user's task" and "relevant session context" directly into the briefing for the @fable-orchestrator subagent. \n
- Boundary markers: The skill does not provide instructions to use delimiters (like XML tags or triple quotes) or "ignore embedded instructions" warnings when passing user data to the subagent. \n
- Capability inventory: SKILL.md: The orchestration uses the subagent_type capability to spawn @fable-orchestrator, which is documented to have access to Bash for verification commands. \n
- Sanitization: No explicit sanitization, validation, or escaping of the user-provided data is mandated before it is passed to the next agent in the chain. \n
- Mitigation Note: The skill includes a "Mandatory delivery gate" that invokes a separate double-check skill on finished deliverables, which provides a layer of human-in-the-loop or automated verification against malformed or malicious outputs.
Audit Metadata