how
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses templates in
EXPLAINER-PROMPT.mdandEXPLORER-PROMPT.mdto guide subagents, which are vulnerable to injection attacks. - Ingestion points: User-provided questions are interpolated into the
{QUESTION}placeholder. Additionally, findings from 'explorer' subagents, which are derived from reading external codebase content, are interpolated into the{EXPLORER_FINDINGS_ALL}placeholder in the explainer template. - Boundary markers: The templates lack XML tags, unique delimiters, or explicit instructions to treat the interpolated content as untrusted data, increasing the risk that the subagent might follow instructions embedded within the codebase or the user's question.
- Capability inventory: The agents have access to file system search and read tools (
rg,find,sed), allowing them to traverse the repository. - Sanitization: There is no evidence of sanitization or filtering for the interpolated variables before they are passed to the subagents.
Audit Metadata