sherpa
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it is designed to ingest and process untrusted user-supplied epics, stories, and task descriptions for decomposition.
- Ingestion points: The skill takes 'Raw MAP input' from users or external AI-generated task lists (like those from Linear Agent) as described in
SKILL.mdandreference/task-breakdown.md. - Boundary markers: It employs structured handoff formats, such as
## NEXUS_HANDOFFand## SHERPA_TO_IMPL_HANDOFF, to attempt context isolation when delegating to other agents. - Capability inventory: The skill coordinates several high-privilege agents including
Builder(code implementation) andForge(prototyping), creating a path where injected instructions in a task description could lead to unauthorized code changes. - Sanitization: The instructions implement a 'Quality Gate' using the INVEST checklist and mandatory exit criteria to validate task integrity, though these are primarily behavioral rather than technical sanitization filters.
Audit Metadata