closed-loop
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to evaluate current state and gaps by reading from repositories, documentation, and conversation context. This creates a surface where instructions embedded in those external sources could attempt to influence the agent's behavior.
- Ingestion points: Repository files, external documentation, and conversation history referenced in the 'Work Way' and 'Red Lines' sections of SKILL.md.
- Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between the agent's core instructions and the external data being analyzed.
- Capability inventory: The skill workflow requires the agent to 'act' (动手) and 'verify' (验证), which typically involves file system access and shell command execution via the agent's underlying toolset.
- Sanitization: There are no instructions for sanitizing or escaping the content retrieved from external sources before it is processed by the agent's reasoning loop.
Audit Metadata