context-optimization
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data which represents a standard attack surface for indirect prompt injection. \n
- Ingestion points: Untrusted data enters the agent context through the
summarize_contentfunction and its derivatives inscripts/compaction.py, as well as via theObservationStoreclass. \n - Boundary markers: While the skill body recommends using reference markers like
[Obs:{ref_id} elided], the scripts do not implement or enforce strict boundary delimiters or instructions to ignore embedded directives in the summarized text. \n - Capability inventory: The skill is restricted to regex-based text extraction, string manipulation, and MD5 hashing. It lacks capabilities for network requests, filesystem modification, or arbitrary command execution. \n
- Sanitization: The compaction logic uses regex to filter for metrics and key findings, which provides a layer of heuristic filtering, but it does not explicitly sanitize for malicious instructions within the extracted text.
Audit Metadata