ketchup
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes chat history and subagent reports, which are external data sources that could potentially contain malicious instructions.
- Ingestion points: Chat history, subagent reports, and messages from other users are ingested as described in the 'Gather what changed' section.
- Capability inventory: The skill frontmatter specifies 'disable-model-invocation: true', and the instructions explicitly command the agent to 'Keep this turn read-only' and 'do not change code, start an app or a job, or post anything.'
- Boundary markers: The instructions provide a behavioral boundary by mandating a read-only state, though they do not specify technical delimiters for external content.
- Sanitization: There are no instructions for sanitizing or escaping the external content processed from the chat history.
Audit Metadata