why
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize large amounts of data from external, potentially attacker-controlled sources.
- Ingestion points: External data is ingested in
SKILL.md(Step 3) and processed by subagents using templates inreferences/investigator-prompt.mdandreferences/synthesizer-prompt.md. Sources include PR bodies, Slack messages, Notion documents, Linear tickets, and Sentry error logs. - Boundary markers: The subagent prompts use markdown headers and blockquotes to delimit instructions from data (e.g.,
> {QUESTION}in the investigator template), but these provide only limited protection against sophisticated injection attacks embedded in the source data. - Capability inventory: The skill uses
git,gh(GitHub CLI), andrg(ripgrep) for local repository analysis. It also utilizes several MCP tools for read-only access to corporate services (Notion, Slack, Linear, Datadog, Sentry, Databricks). - Sanitization: There is no explicit sanitization or filtering of the fetched content before it is processed by the subagents or presented to the user, relying instead on the model's internal safety guardrails.
Audit Metadata