how
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from user questions and analyzed codebases, creating a surface for indirect prompt injection when interpolating findings between agents.
- Ingestion points: User-supplied {QUESTION} and contents of the codebase analyzed in SKILL.md and explorer-prompt.md.
- Boundary markers: The prompt templates do not use explicit delimiters or ignore instructions warnings.
- Capability inventory: Spawns subagents with access to Read, Grep, and Glob tools; however, these are restricted to readonly: true mode.
- Sanitization: No specific sanitization of external data is performed before prompt interpolation.
- [COMMAND_EXECUTION]: The skill orchestrates the spawning of subagents using platform-specific tools and reads configuration from local files.
- Evidence: Mentions usage of Task, Agent, and spawn_agent tools to perform complexity assessment, exploration, and synthesis.
- Local file access: Accesses ~/.cursor/rules/pstack-models.mdc or ~/.agents/pstack-models.md to retrieve model configuration settings.
Audit Metadata