cavecrew
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection through its subagent delegation model.
- Ingestion points: The
cavecrew-investigatorsubagent processes data from the local filesystem (code definitions, symbols, and cross-references) as described inSKILL.md. - Boundary markers: Findings from subagents are injected "verbatim" into the main thread context according to
SKILL.md, without explicit delimiters or instructions to disregard instructions embedded in the retrieved data. - Capability inventory: The
cavecrew-buildersubagent has the capability to perform surgical file edits (1-2 files), creating a potential path for a successful injection to result in unauthorized code changes. - Sanitization: The instructions do not specify any sanitization, escaping, or validation of the content retrieved by subagents before it is processed by the main agent thread.
Audit Metadata