delegate-explore
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites and third-party platforms, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: Data enters the agent context via WebSearch, WebFetch, and MCP server integrations (Notion, Confluence, Jira) as specified in
SKILL.md. - Boundary markers: The documentation notes that prompt injection risks are handled by isolating the untrusted content inside a subagent child process ("子プロセス内に隔離され"), preventing direct modification of the main agent's context.
- Capability inventory: The tool runs local scripts through Node.js execution shims (
delegate-cli.mjs) to handle logic dispatching across various models and subagents. - Sanitization: Input boundaries and sanitization logic are encapsulated inside the compiled execution utility rather than defined explicitly in the shell shims.
Audit Metadata