playbook
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a research pipeline where external sources are fetched verbatim and then processed by subagents to create synthesis briefs. This process ingests untrusted data from the internet or external files into the agent's workflow.
- Ingestion points: External content is fetched to './.workflow/scratch/' as an audit trail and then summarized by a 'medium' tier model in SKILL.md.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when processing the raw fetched content.
- Capability inventory: The orchestration framework has the ability to spawn subagents, perform parallel code editing ('isolation: worktree'), and execute commands in 'tmux' panes.
- Sanitization: There is no evidence of filtering, escaping, or sanitizing the raw source material before it is passed to the synthesis agent or the main orchestrator.
Audit Metadata