grace-refactor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including source code files and XML configuration artifacts (
.grace/graph/index.xml,.grace/verification/index.xml), which could be used to embed malicious instructions. - Ingestion points: Project source code and durable graph/verification artifacts located in the
.gracedirectory. - Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions embedded within the processed data.
- Capability inventory: The skill allows file system read/write operations and command execution (
grace lint). - Sanitization: No sanitization, validation, or escaping of the ingested file content is specified.
- [COMMAND_EXECUTION]: The instructions direct the agent to run the
grace lint --path <project-root>command. While this tool is central to the skill's stated purpose, the execution of project-specific binaries depends on the integrity of the local environment.
Audit Metadata