messaging-the-human
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process unstructured text input from human participants, which represents a surface for indirect prompt injection if the agent interprets these responses as instructions.
- Ingestion points: Untrusted data enters the agent context through human typed-replies in the
humanAnswersobject and instructions retrieved via therig gateway human mode roomcommand. - Boundary markers: The skill instructions do not mandate the use of delimiters or 'ignore' instructions when the agent parses the human's text, although it warns against confusing text with option IDs.
- Capability inventory: The skill utilizes a suite of CLI tools (
rig gateway human,rig queue,rig send) that allow the agent to query participant lists, inspect entities, create queue items, and record decisions. - Sanitization: While outgoing messages undergo size and accessibility checks, there is no evidence of sanitization or validation logic for incoming text from humans before it is processed by the agent.
Audit Metadata