ideate
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user input ($ARGUMENTS) and persistent memory (memory.list), which is then used to prompt subagents and judges across multiple phases. While the skill includes several structural mitigations, the complexity of the data flow creates an attack surface for indirect prompt injection.
- Ingestion points: The skill takes a problem statement and optional seed ideas from the user in Phase 0 (SKILL.md). It also reads 'mechanics-only' lessons from LoreKit memory (rules/self-improvement-loop.md) at the start of every run.
- Boundary markers: The workflow implements clear phase boundaries and explicit instructions to generators to avoid evaluation (rules/divergence.md). Judges are provided with a specific rubric restatement and process anonymized, shuffled ideas to mitigate bias (rules/idea-scoring.md).
- Capability inventory: The skill dispatches parallel subagents using agent-dispatch (rules/divergence.md), invokes the external 'confidence' and 'critical' skills for validation (rules/idea-scoring.md), and persists operational data using memory.write (rules/self-improvement-loop.md).
- Sanitization: User-provided seed ideas are restyled into the skill's standard house style before being pooled to prevent style-based judge bias and reduce the impact of embedded formatting (rules/idea-scoring.md).
Audit Metadata