idea-refine
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to be codebase-aware, which introduces a surface for indirect prompt injection.
- Ingestion points: The skill instructs the agent to use
Glob,Grep, andReadtools to scan local files for relevant context, architecture, and constraints. - Boundary markers: The instructions do not define boundary markers or delimiters to isolate the ingested codebase content from the agent's instructions.
- Capability inventory: The agent is authorized to write markdown files to the local filesystem (
docs/ideas/) and execute a local bash script. - Sanitization: No sanitization or escaping of the ingested file content is specified before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill documentation includes instructions to execute a local bash script (
scripts/idea-refine.sh). While the script itself is benign and performs standard directory initialization (including safety checks against symlink attacks), the use of shell execution represents an active capability that users should be aware of.
Audit Metadata