hosted-agents
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The architecture described in the skill handles untrusted data from multiple external sources, which establishes a surface for potential indirect prompt injection.
- Ingestion points: The documentation details agents ingesting data from Slack message threads, GitHub PR content, and web DOM/React internals via a Chrome extension (SKILL.md).
- Boundary markers: No explicit guidance is provided for implementing delimiters or "ignore previous instructions" guards when interpolating external data into the prompt context.
- Capability inventory: The agents have the capability to execute shell tools, perform git operations (commit/push), create pull requests, and spawn autonomous sub-agent sessions (SKILL.md).
- Sanitization: There is no mention of sanitizing, validating, or escaping external content before it is processed by the model.
- [METADATA_POISONING]: The skill contains a self-reported 'risk: critical' field in its YAML frontmatter. This is a self-authoritative claim about its own risk profile that could be used to manipulate security assessments or user perception of the skill's sensitivity.
Audit Metadata