ultra-reasoning-operator
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core workflow requires the agent to ingest and analyze data from various external and internal sources, which inherently creates a surface for indirect prompt injection.
- Ingestion points: Instructions in
SKILL.mddirect the agent to gather evidence from repository files, logs, tests, official documentation, and broad web sources. - Boundary markers: The skill does not define specific text delimiters or explicit instructions for the agent to ignore commands found within these data sources during the ingestion phase.
- Capability inventory: The operator loop involves repository tool usage, test execution, and web browsing, which could be targeted by injected content.
- Sanitization: The skill addresses this surface through a self-review mechanism in
references/adversarial-review.md, instructing the agent to perform a 'Security attack' pass to specifically look for prompt/tool injection surfaces in the proposed solution.
Audit Metadata