cobalt-core

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The reference documentation (specifically references/concurrency-patterns.md and references/testing-patterns.md) provides numerous shell command examples using tools such as rg, grep, go test, and make. These commands are standard for code analysis, testing, and development workflows associated with the Cobalt Core project.
  • [PROMPT_INJECTION]: The skill's 'Phase 3: EXTEND' instructions direct the agent to analyze external repositories (including READMEs, source code, and configuration files) to generate new reference documentation. This creates a surface for indirect prompt injection where instructions embedded in processed external data could potentially influence the agent's behavior.
  • Ingestion points: Phase 3 repository analysis instructions in SKILL.md.
  • Boundary markers: Absent; the instructions do not specify delimiters or constraints for the ingested data.
  • Capability inventory: The skill is granted access to Bash, Write, Edit, Read, and Agent tools.
  • Sanitization: No explicit sanitization or validation steps for content from analyzed repositories are mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 12:34 PM