recipe-reverse-engineer

Pass

Audited by Gen Agent Trust Hub on Jul 22, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of analyzing external codebase content.
  • Ingestion points: Untrusted data enters the agent context via the user-specified target_path (SKILL.md) which is then processed by multiple sub-agents.
  • Boundary markers: The skill does not implement delimiters or 'ignore' instructions to prevent agents from following commands embedded in the source code being analyzed.
  • Capability inventory: The skill possesses significant capabilities including spawning multiple sub-agents (spawn_agent), reading arbitrary files within the target path, and writing documentation to the local filesystem (docs/prd/, docs/design/).
  • Sanitization: There is no evidence of content validation or escaping of the ingested code before it is passed to the AI models.
  • [COMMAND_EXECUTION]: The skill relies on a user-provided $ARGUMENTS variable to define the target directory in SKILL.md. This pattern represents a risk if the platform execution environment fails to sanitize these arguments before using them in file system or shell-based operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 22, 2026, 10:14 PM
Security Audit — agent-trust-hub — recipe-reverse-engineer