threat-modeling
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically source code, architecture diagrams, and business context, to perform security analysis.
- Ingestion points: System architecture extraction (SKILL.md Step 2) and repository-wide code analysis involve reading arbitrary files from a user's environment.
- Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when interpolating code content into the LLM context.
- Capability inventory: The skill possesses the capability to make network requests to local and vendor API endpoints and execute MCP tools (e.g., gitnexus) to fetch data or post assessments.
- Sanitization: While the skill includes a 'PhoenixDataShieldingService' to protect proprietary intellectual property from exposure, it lacks documented sanitization or escaping mechanisms to prevent instructions within the analyzed code from overriding the agent's primary directives.
Audit Metadata