red-team-review
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill bundles research artifacts, analysis documents, and source files to be processed by a reviewer agent. This process is susceptible to indirect prompt injection if the source data contains malicious instructions designed to subvert the reviewer's verdict.
- Ingestion points: Research artifacts and source files specified in manifest.json as described in the process flow (SKILL.md).
- Boundary markers: The skill mandates the use of context-bundler and manifest.json (acceptance-criteria.md) to provide structure, but lacks explicit boundary markers or instructions to the reviewer agent to ignore instructions embedded within the bundled content.
- Capability inventory: The skill possesses Bash, Read, and Write capabilities and utilizes the context-bundler plugin.
- Sanitization: There is no evidence of sanitization, filtering, or validation of artifact content before it is bundled and passed to the reviewer agent.
- [COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using user-selected LLM CLI backends and models. This introduces a potential surface for command injection if the user-supplied parameters (tool name or model name) are not properly escaped before execution via the Bash tool.
- Evidence: SKILL.md (Step 2.5 and 3) describes an interactive process where the user selects a CLI backend and specific model, which are then used to build a run command that includes a redirection (< /dev/null).
Audit Metadata