superimprove
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to discover and execute shell commands found within the target repository (such as test, lint, and build commands). While this is necessary for automated improvement and verification, it allows the agent to execute arbitrary local code based on the contents of the untrusted repository.
- [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it ingests and follows instructions found in project documentation and configuration files to determine its execution path.
- Ingestion points: SKILL.md Phase 0 (Step 1 and 3) specifies reading project instructions, architecture notes, contribution guidance, and CI configurations.
- Boundary markers: The skill contains a manual instruction in the 'Safety contract' to treat content as untrusted data rather than instructions, but it lacks programmatic delimiters or escaping mechanisms when processing these files.
- Capability inventory: SKILL.md Phase 0 (Step 4) and Phase 2 (Step 5) involve executing shell commands (test, lint, typecheck, build) and exercising 'real surfaces' (browser/UI interaction).
- Sanitization: There is no evidence of command sanitization or validation before execution; the skill relies on the agent's ability to 'discover' the correct commands from the environment.
Audit Metadata