aris-ablation-planner

Pass

Audited by Gen Agent Trust Hub on May 6, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: Direct prompt injection vulnerability exists where the $ARGUMENTS placeholder is interpolated directly into a markdown header used as context for the agent.
  • [PROMPT_INJECTION]: Indirect prompt injection surface identified through the ingestion and processing of untrusted project data.
  • Ingestion points: Step 1 reads various project files including docs/research_contract.md, CLAUDE.md, and EXPERIMENT_LOG.md.
  • Boundary markers: The skill lacks delimiters (e.g., XML tags or triple quotes) or explicit 'ignore instructions' warnings when passing the content of these files to the mcp__codex__codex tool in Step 2.
  • Capability inventory: The skill has access to high-impact capabilities including Bash(*), Write, and Edit, which could be exploited to modify the codebase or execute commands if the agent's logic is subverted via malicious file content.
  • Sanitization: No sanitization, escaping, or validation of the data read from external project files is performed before interpolation into the prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
May 6, 2026, 01:42 AM
Security Audit — agent-trust-hub — aris-ablation-planner