fresh-review
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted external data (artifacts), which is a potential surface for indirect prompt injection attacks.
- Ingestion points: Untrusted artifacts such as code, documents, research, and plans are ingested and inspected as described in the 'Establish the target' section of SKILL.md.
- Boundary markers: The skill does not prescribe the use of boundary markers (like XML tags or specific delimiters) to isolate the artifact content from the agent's instructions, though it does suggest using separate review contexts.
- Capability inventory: SKILL.md mentions the use of 'subprocess workers' and 'running checks', which are capabilities that could be triggered or abused by malicious instructions embedded within a reviewed artifact.
- Sanitization: The skill's instructions do not include requirements or methods for sanitizing, filtering, or escaping the content of the artifacts before they are processed by the agent.
Audit Metadata