principle-experience-first
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read a local reference file to determine tool mappings and permission limits, creating a dependency on external data that influences agent behavior.
- Ingestion points: The file
../saltmode/references/host-adapter.mdis read at the start of the session. - Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore or sanitize instructions contained within the adapter file.
- Capability inventory: The skill frontmatter includes
disable-model-invocation: true, which restricts the agent's ability to call models directly while this skill is active. - Sanitization: There is no validation or escaping of the content read from the external host adapter file.
Audit Metadata