how
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the interpolation of untrusted user input and codebase data into subagent prompts without sufficient isolation.\n
- Ingestion points: The skill ingests user input via the
{QUESTION}placeholder and codebase findings via the{EXPLORER_FINDINGS_ALL}placeholder, which are both used to build subagent prompts inreferences/explorer-prompt.mdandreferences/explainer-prompt.md.\n - Boundary markers: The prompt templates lack explicit delimiters (e.g., XML tags or unique separators) or instructions directing the subagents to ignore potential instructions embedded within the variable content.\n
- Capability inventory: The subagents are granted read-only access to the local filesystem using tools such as
Read,Grep, andGlob.\n - Sanitization: No escaping, filtering, or validation is performed on the content read from files or the user-provided question before it is processed by the AI models.
Audit Metadata