recipe-reflect
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes data from multiple source files and user input to update product documentation, creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent context through
$ARGUMENTS(SKILL.md), hypothesis files (Level 1 reflection), and Opportunity files (Level 2 reflection). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested hypothesis or opportunity data.
- Capability inventory: The skill performs file-write operations to several locations, including
docs/product/vision.md,docs/product/learnings.md,docs/discovery/INDEX.md, and various hypothesis/opportunity files. - Sanitization: No explicit sanitization, validation, or filtering of the external content is performed before interpolation into the prompt for the sub-agent or before writing to target files.
- Mitigation: The workflow requires a
[STOP — BLOCKING]checkpoint where the user must explicitly confirm findings from theknowledge-distillerbefore any learnings are promoted or written to the knowledge pyramid.
Audit Metadata