advisor
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates an indirect prompt injection surface by ingesting untrusted external data and passing it to a high-capability advisor model for decision-making support.
- Ingestion points: The instructions in SKILL.md direct the agent to 'pack everything it needs into the prompt,' including 'the code, error output, constraints, and requirements, pasted directly.'
- Boundary markers: There are no requirements for using specific delimiters (like XML tags or triple backticks) or 'ignore instructions' warnings to isolate the untrusted context from the advisor's instructions.
- Capability inventory: The advisor subagent is granted the ability to perform 3 file reads and 1 web search, which could be exploited for data exfiltration or reconnaissance if an injection occurs.
- Sanitization: The skill lacks instructions for escaping, validating, or filtering the content before it is interpolated into the briefing prompt.
- [SAFE]: The skill includes strong security-positive design patterns, such as requiring the advisor to be read-only (no edits, writes, or shell mutations) and explicitly recommending the use of 'disallowedTools: Agent' to prevent recursive subagent calls.
Audit Metadata