specialist-engineering-ai-engineer
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses a subagent architecture that interpolates untrusted user data directly into the subagent's system prompt. This creates a surface where a malicious user could attempt to override the subagent's persona or safety instructions.
- Ingestion points: The variable
{the user's question}in theAgenttool call withinSKILL.mdis the primary entry point for untrusted data. - Boundary markers: No explicit delimiters (like triple quotes or XML tags) or "ignore embedded instructions" warnings are used to wrap the user input within the subagent prompt.
- Capability inventory: While the subagent is primarily designed for guidance and architecture, the persona's role includes developing data pipelines, MLOps infrastructure, and model training, which implies the ability to generate and potentially execute code depending on the agent's environment tools.
- Sanitization: There is no evidence of input validation, filtering, or escaping for the user-provided question before it is embedded into the prompt.
Audit Metadata