recall
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from user reports, issue trackers, and chat history.\n
- Ingestion points: The skill reads from transcripts, shared records (user reports, incidents), issue trackers, and chat channels specified in SKILL.md.\n
- Boundary markers: Mentions a 'portable runtime contract' but does not specify explicit boundary delimiters within the skill instructions to separate untrusted content from system instructions.\n
- Capability inventory: Utilizes git, gh, and filesystem commands (ls, grep) across the workspace.\n
- Sanitization: Explicitly instructs the agent to 'sanitize private context before any public output', which serves as a mitigation step.\n- [COMMAND_EXECUTION]: The skill utilizes shell-based tools including git, gh, ls, and grep to verify current state and search through transcript files.
Audit Metadata