chief-of-staff
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a central hub that ingests user questions and integrated outputs from up to 28 separate skills. This creates a surface for indirect prompt injection where malicious instructions in the input or downstream outputs could influence the agent's synthesis or decision-logging behavior.
- Ingestion points: User questions provided during role invocation in
SKILL.mdand responses from multiple external advisor roles processed inreferences/synthesis-framework.md. - Boundary markers: The skill uses structured invocation syntax (
[INVOKE:role|question]) and specific markdown headers for the synthesis output to separate different contexts. - Capability inventory: Orchestrates a wide array of functional skills (C-suite advisors, cross-cutting tools) and maintains a decision history in
~/.claude/decision-log.md. - Sanitization: Implements comprehensive loop prevention (maximum depth of 2 and circularity blocking) and quality checks, although it does not specify explicit sanitization for adversarial text patterns within the questions themselves.
Audit Metadata