arena
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements an 'Arena' pattern where multiple parallel candidates generate content that is later cross-judged and synthesized into a final artifact. This architecture inherently involves the processing of untrusted data generated by other model instances.
- Ingestion points: Candidate artifacts and rationales are produced in Phase B and ingested by the 'Judge' in Phase C and the 'Picker' in Phase D of
SKILL.md. - Boundary markers: The instructions mandate standalone briefs for candidates but do not specify the use of delimiters (like XML tags or markdown blocks) or safety instructions to prevent the synthesizer from obeying instructions embedded within candidate outputs.
- Capability inventory: The skill environment allows for parallel task spawning, git worktree manipulation, and file writes to
/tmp/arena-<slug>/. - Sanitization: There are no explicit instructions for the agent to sanitize, escape, or ignore natural language instructions found within the candidate artifacts before grafting them into the final result.
Audit Metadata