grilling
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest data from the local environment, such as the filesystem and tool outputs, via sub-agents to find facts. This creates a surface for indirect prompt injection if the external data sources contain malicious instructions.
- Ingestion points: Filesystem and environment data retrieved by sub-agents (SKILL.md).
- Boundary markers: Absent; there are no instructions to delimit or sanitize the data retrieved from the environment.
- Capability inventory: The agent is authorized to access the filesystem and use tools automatically (SKILL.md).
- Sanitization: Absent; the skill does not specify any validation or filtering for the environment facts it retrieves.
- [COMMAND_EXECUTION]: The skill instructions mandate automated environment exploration, telling the agent to use tools and sub-agents without seeking user permission for each step.
- Evidence: 'When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it — don't ask the user for anything you could look up yourself.' (SKILL.md)
Audit Metadata