self-healing-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from error logs and library documentation to generate patches, which represents a vulnerability surface for indirect instructions. Ingestion points: Error logs (Step 1), context7 MCP documentation (Step 2), and permanent_memory.md (Step 3). Boundary markers: The skill uses a confidence scoring system (Step 5) and requires cross-referencing multiple sources. Capability inventory: Access to Read, Glob, and Grep tools; generates patches as draft artifacts. Sanitization: All patches require manual user approval and execution via a separate task flow (Step 7).
- [SAFE]: The skill follows secure AI agent design principles by enforcing human-in-the-loop oversight for all mutations. Access Control: Reading .envrc is used purely for feature toggle verification (AF_SELF_HEAL_DISABLED) rather than secret harvesting. Restricted Scope: The skill explicitly forbids untrusted external sources like web searches, mitigating the risk of incorporating malicious or incorrect code from the internet.
Audit Metadata