persona-updater
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data sources which could be exploited to influence agent behavior through indirect prompt injection.
- Ingestion points: The skill reads external data from "pilot debrief reports, feedback, and research" (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or boundary markers to isolate external data from the system prompt.
- Capability inventory: The skill has the capability to read local files ("Load all persona files") and write/modify them ("Edit persona files") (SKILL.md).
- Sanitization: No explicit sanitization or filtering of external content is mentioned.
- Mitigation: The skill implements a human-in-the-loop safety measure by requiring the agent to "Show the diff to the user for approval" before applying any file updates.
Audit Metadata