trellis-break-loop
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to update its own internal reference documents, such as 'thinking guides' in
.trellis/spec/guides/, based on its analysis of a recent bug. This creates a surface where adversarial content encountered during the debugging process could be inadvertently promoted into the agent's persistent instructions. - Ingestion points: Data regarding the bug and its fix enter the context from the agent's recent history (SKILL.md).
- Boundary markers: None; the skill does not include delimiters or instructions to ignore embedded commands within the bug context.
- Capability inventory: The agent is instructed to write files and perform Git commits (SKILL.md).
- Sanitization: None; the skill encourages direct knowledge capture into spec files without validation.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to perform 'Immediate Actions' which include updating file templates and executing Git commits ('Commit the spec updates'). This grants the agent autonomy to modify the codebase and documentation based on potentially untrusted runtime context.
Audit Metadata