agent-knowledge-loops
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a learning loop designed to ingest data from external sources (review threads, pull requests, and bot comments) to generate instructions (rules) for future agent executions. If a repository is public, an attacker could potentially influence the agent's future behavior through malicious review comments.
- Ingestion points: External data is harvested from pull request review threads, reviewer bot feedback, and commit messages as detailed in the 'signals-and-measurement.md' ladder.
- Boundary markers: To minimize injection risk, the skill suggests using deterministic 'pointer' lines in prompts that load conventions from a file rather than embedding them directly in the prompt context.
- Capability inventory: The agents governed by these rules are described as having file-system access, terminal command execution, and tool-calling capabilities within an engineering fleet.
- Sanitization: Mitigation measures include a required 70% human precision gate, structural filters that ignore agent self-reports, and a strict-JSON parser that validates that every model-cited evidence ID corresponds to a verified task artifact.
Audit Metadata