arena
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses local configuration files to manage model selection.
- Evidence: It reads from
~/.config/rstack/models.mdin Phase A and Phase C to identify available subagent and judge models. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and grafts content from parallel subagents, creating a vulnerability surface for indirect instructions.
- Ingestion points: The skill processes rationales and artifacts generated by subagents in Phase B and Phase C.
- Boundary markers: No delimiters or ignore-instructions are used when reading candidate rationales.
- Capability inventory: Spawns subagents, reads from the file system, and writes synthesized artifacts.
- Sanitization: No validation or filtering is performed on subagent-generated rationale strings before they are processed by the judge or parent agent.
Audit Metadata