ultraqa
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection vulnerability surface. The skill ingests untrusted data from the local environment (test outputs, build logs, lint errors) and interpolates it directly into subagent prompts for diagnosis and fixing.
- Ingestion points: Output from verification commands (tests, builds, lints, custom patterns) in SKILL.md.
- Boundary markers: None. Data is placed directly into prompt templates like 'Output: [test/build output]'.
- Capability inventory: File system modification (via executor subagent), file deletion (rm -f), and shell command execution.
- Sanitization: No sanitization or escaping of the ingested command output is performed before it is passed to the subagent.
- [COMMAND_EXECUTION]: Autonomous execution of shell commands and file modifications. The skill is designed to run various project commands (npm test, build scripts, etc.) and perform state cleanup using 'rm -f .omc/state/ultraqa-state.json'. This autonomous loop grants the agent significant control over the local project structure and execution environment.
Audit Metadata