incident-response-smart-fix
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection vulnerability surface. The skill accepts user input via the
$ARGUMENTSparameter and interpolates it directly into prompts for specialist sub-agents with significant system capabilities. - Ingestion points: The
$ARGUMENTSvariable is used inSKILL.mdand multiple times inresources/implementation-playbook.md(e.g., in Phase 1: Issue Analysis and the final prompt invocation). - Boundary markers: The skill lacks delimiters (such as XML tags, triple quotes, or unique markers) or specific 'ignore instructions' warnings when embedding user-provided data into sub-agent prompts.
- Capability inventory: The workflow includes specialist agents that perform file system modifications (Phase 3: Fix Implementation), execute shell commands via test runners (Phase 4: Verification), and manage version control systems like git bisect (Phase 2).
- Sanitization: There is no evidence of input validation, escaping, or filtering to prevent the agent from accidentally or maliciously obeying instructions embedded within the issue description or observability data.
Audit Metadata