breach
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill documents explicit prompt injection and jailbreak patterns, such as 'Ignore all previous instructions' and 'DAN' (Do Anything Now), within its AI red teaming references (e.g.,
references/ai-red-teaming.md). Although these are intended as test cases for adversarial simulations against target systems, the presence of these instructions in the skill's context can be interpreted as a prompt injection risk. - [INDIRECT_PROMPT_INJECTION]: The agent is designed to ingest and analyze untrusted external data, including target system specifications, RAG (Retrieval-Augmented Generation) corpora, and third-party documentation. This ingestion surface is vulnerable to indirect prompt injection where malicious instructions embedded in the analyzed data could attempt to hijack the agent's goal or influence its output.
- Ingestion points: Technical scope definitions (PASTA Stage 2), external documents, RAG data sources, and web URLs provided during red teaming engagements.
- Boundary markers: The skill relies on structured security frameworks (STRIDE, MITRE ATLAS, PASTA) to guide its analysis, but does not specify explicit delimiters or 'ignore instructions' warnings for raw data inputs.
- Capability inventory: The agent generates structured attack scenarios, remediation specifications, and automated handoffs to other specialized agents (e.g., Builder, Sentinel).
- Sanitization: The instructions do not define methods for sanitizing, filtering, or escaping external content before it is processed by the LLM.
Audit Metadata