skill-upgrader
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external skill files and interpolates it directly into sub-agent prompts without sanitization or boundary markers.
- Ingestion points: The skill reads external files via the
Readtool and passes the raw text to four sub-agents using theTasktool. - Boundary markers: There are no delimiters (like XML tags or triple quotes) or explicit instructions for the sub-agents to ignore potentially malicious commands embedded within the input skill text.
- Capability inventory: The sub-agents have the ability to execute shell commands (
uv run python scripts/ragie_query.py) and write findings to a shared blackboard file. - Sanitization: No escaping or validation is performed on the content of the input skill before it is interpolated into the
{path}variable in the sub-agent prompts. - [COMMAND_EXECUTION]: The skill uses
uv run pythonto execute a local script (scripts/ragie_query.py) to interface with the Ragie RAG service. - The execution pattern
uv run python scripts/ragie_query.py -q "..." -p ...is repeated across all four sub-agents to query specific knowledge partitions.
Audit Metadata