figure-it-out
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed for cross-cutting tasks such as migrations and auditing large changes, which inherently requires the agent to ingest and process project data that may contain untrusted content.
- Ingestion points: Project artifacts, source code, and migration targets analyzed during the design and execution phases (SKILL.md, references/figure-it-out-procedure.md).
- Boundary markers: The skill does not provide explicit markers or delimiters to separate the skill's operational instructions from potentially malicious embedded instructions in the processed files.
- Capability inventory: The skill directs the agent to make changes to 'real artifacts' (Phase C) and delegates high-privilege tasks to other skills such as 'architect' and 'show-me-your-work'.
- Sanitization: There are no documented steps for sanitizing or validating external input before it is used to influence the workflow or modification steps.
Audit Metadata