ritualsmash
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external content to identify and remove workflow steps, creating a surface for indirect prompt injection. \n
- Ingestion points: Reads shared instructions, launcher preambles, brief templates, reviewer/shepherd prompts, and samples of recent reports/traces as specified in SKILL.md. \n
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content within the ingested data. \n
- Capability inventory: The skill has the authority to directly edit and delete shared rule files, modify project land scripts, and issue commands to other active agents to change their behavior. \n
- Sanitization: There is no mention of sanitizing or validating the content read from reports or external prompts before it is used to justify the removal of system rules.\n- [COMMAND_EXECUTION]: The skill is designed to autonomously modify the project's infrastructure and shared rules using shell utilities. \n
- Evidence: SKILL.md instructs the agent to 'Edit the shared rule files directly: delete the ritual', use 'grep' for ritual words, and modify 'land scripts' without requiring prior user approval for reversible actions.
Audit Metadata