development-team
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and resolve information from several YAML files (e.g., project.yaml, mission.yaml, active slice.yaml) to determine its tasks and context. If these files are part of an untrusted or compromised codebase, an attacker could embed malicious instructions that the agent might follow.
- Ingestion points: Reads configuration from project.yaml, mission.yaml, and active slice.yaml in the local directory.
- Boundary markers: The instructions do not define delimiters or warnings for the agent to ignore embedded instructions within these data files.
- Capability inventory: The agent has access to local CLI tools (rig) and environment variables ($OPENRIG_HOME).
- Sanitization: There are no instructions for sanitizing or validating the content of the ingested YAML files.
Audit Metadata