arena
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill does not contain any malicious code, hardcoded credentials, or obfuscated commands. It strictly operates on local files and temporary directories.
- [INDIRECT_PROMPT_INJECTION]: The skill manages a workflow where multiple sub-agents generate content that is later processed and judged. This creates a surface for indirect prompt injection if a candidate attempts to influence the judge or parent agent. The skill mitigates this risk through several controls:
- Ingestion points: The parent agent reads candidate artifacts and rationales in the 'Pick' and 'Graft' phases (SKILL.md).
- Boundary markers: Instructions require isolating candidates in 'task-specific temporary directories' or 'isolated local paths' to prevent cross-contamination.
- Capability inventory: The skill explicitly prohibits sub-agents from communicating with humans or external systems, and limits them to authorized local changes.
- Sanitization: The 'Verify' phase requires inspecting actual output rather than relying on agent reports, and an 'independent read-only judge' is used to evaluate results.
- [EXTERNAL_DOWNLOADS]: The documentation identifies that parts of the skill are adapted from a public repository hosted by a well-known technology organization (Anysphere/Cursor). No automated downloads occur at runtime.
Audit Metadata