recipe-reverse-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an automated workflow for analyzing external codebase data, which creates a potential surface for indirect prompt injection attacks where malicious instructions in the source code could influence subagent behavior.\n
- Ingestion points: The skill ingests untrusted content from a user-specified codebase path ($USER_TARGET_PATH) to drive the discovery and documentation generation process.\n
- Boundary markers: The prompt templates for subagents (such as the
prd-creatorin Step 2 ortechnical-designerin Step 7) lack explicit boundary delimiters or instructions to treat codebase variables as data-only, increasing the risk that embedded instructions in the source code could be interpreted by the LLM as part of the system prompt.\n - Capability inventory: The orchestrator coordinates multiple subagents with capabilities to perform deep repository investigation (file reading) and generate documentation artifacts (file writing) to the local disk in the
docs/directory.\n - Sanitization: The workflow does not include specific sanitization, filtering, or validation steps to scrub potential prompt injection payloads from the source code identifiers, comments, or documentation extracted during the discovery phase.
Audit Metadata