red-team
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates untrusted external content (the artifacts being reviewed) directly into the prompt for the subagent without delimiters or sanitization. A malicious document could contain instructions that attempt to hijack the 'Devil's Advocate' persona or bypass the review instructions.
- Ingestion points: Artifact content is inserted into the
red-team-prompt.mdtemplate at the placeholders[FULL TEXT of the design doc]and[FULL TEXT of the implementation plan]. - Boundary markers: Absent. The prompt template does not use clear delimiters (such as XML tags or unique markers) or specific instructions to the model to ignore potentially conflicting commands within the ingested text.
- Capability inventory: The subagent's primary capability is text analysis and the generation of structured issue reports (Fatal, Significant, Minor). The skill does not currently invoke sensitive system tools or network operations, though it is intended for use within an orchestration framework.
- Sanitization: None. The skill assumes the provided artifact text is safe to process and does not perform validation or escaping before interpolation.
Audit Metadata