agent-instructions
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill establishes a structured architecture for agent context management using 'progressive disclosure' via a router system. This design prevents context pollution and ensures agents only encounter rules relevant to their current task.
- [SAFE]: The provided Python scripts (
check_budgets.py,check_reachable.py) facilitate local auditing of instruction files for word count limits and link integrity. Both scripts use standard library components and implement safe path resolution to mitigate directory traversal risks. - [SAFE]: Implements defensive patterns for development environments, specifically advising the use of heredocs for git commits (
git commit -F -) to eliminate the risk of accidental shell command substitution from backticks in commit messages. - [SAFE]: Strongly advocates for the 'least privilege' and 'deterministic enforcement' principles by encouraging the use of build-time schema validation for environment variables and unit tests to enforce architectural invariants, rather than relying on agent compliance with text-based instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill defines the workflow for agents to consume instruction files from a repository, which is a standard surface for indirect prompt injection if those files are maliciously modified.
- Ingestion points: Entry files (
AGENTS.md,CLAUDE.md) and referenced documentation indocs/orknowledge/folders. - Boundary markers: Recommends structural isolation of instructions using a router table, though it does not mandate specific platform-native delimiters for instruction blocks.
- Capability inventory: Documented capabilities include subprocess execution (git, python, framework CLIs), file system write access for documentation and environment variables, and database migration execution.
- Sanitization: The skill focuses on auditing rules for reachability and length but does not include specific sanitization logic for the content of the instructions themselves, instead emphasizing migration of critical rules into code paths.
Audit Metadata