aris-ablation-planner
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Direct prompt injection vulnerability exists where the
$ARGUMENTSplaceholder is interpolated directly into a markdown header used as context for the agent. - [PROMPT_INJECTION]: Indirect prompt injection surface identified through the ingestion and processing of untrusted project data.
- Ingestion points: Step 1 reads various project files including
docs/research_contract.md,CLAUDE.md, andEXPERIMENT_LOG.md. - Boundary markers: The skill lacks delimiters (e.g., XML tags or triple quotes) or explicit 'ignore instructions' warnings when passing the content of these files to the
mcp__codex__codextool in Step 2. - Capability inventory: The skill has access to high-impact capabilities including
Bash(*),Write, andEdit, which could be exploited to modify the codebase or execute commands if the agent's logic is subverted via malicious file content. - Sanitization: No sanitization, escaping, or validation of the data read from external project files is performed before interpolation into the prompt.
Audit Metadata