astra-instruction-audit
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes defensive instructions to prevent prompt injection by explicitly telling the agent to treat argument text and audited content as untrusted evidence rather than workflow commands. It specifically warns the agent to ignore embedded requests to change the workflow.
- [DATA_EXFILTRATION]: The instructions establish clear data boundaries, prohibiting the reading of secrets, hidden local state, or private untracked files. It further instructs the agent to never send private instructions, source code, or internal identifiers to external web or MCP tools.
- [REMOTE_CODE_EXECUTION]: The skill explicitly forbids running installations, deployments, or application tests during the audit process, mitigating the risk of executing untrusted code found in scripts or documents.
- [INDIRECT_PROMPT_INJECTION]: The skill recognizes the risk of processing data from the repository and provides a mandatory evidence-handling framework. It specifies ingestion points (SKILL.md, AGENTS.md), notes the presence of strong boundary markers (instructions to treat text as evidence), inventories capabilities (file read/write via local tools), and mandates sanitization through behavioral constraints.
- [COMMAND_EXECUTION]: The skill utilizes standard local tools like
rg(ripgrep) andgitfor file discovery. These operations are scoped to project-owned tracked files and are used for their intended purpose of inventory management.
Audit Metadata