smart-shot
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest complex user prompts and transform them into a 'domain graph' and 'intent graph' which authorize subsequent 'ACTIONS' (e.g., creating, configuring, deploying). This architecture represents a significant attack surface where adversarial input could potentially influence the derived topology and specialist charters to perform unintended actions.
- Ingestion points: The control loop in SKILL.md treats every user prompt as evidence to be classified into an intent graph.
- Boundary markers: The framework attempts to mitigate risks through 'isolation rules' and 'coupling modes' described in references/intent-mechanics.md, separating discovery from commitment when safety or security boundaries apply.
- Capability inventory: The skill acknowledges high-impact capabilities including target-state changes such as deploying, communicating, or purchasing as defined in references/action-mechanics.md.
- Sanitization: The skill relies on 'layered checks' and 'independent qualified evaluation' (verification mechanics) to validate outcomes before final integration.
- [DYNAMIC_EXECUTION]: The framework dynamically generates 'Compiler prompt blocks' and 'Runtime contracts' for specialized sub-agents based on the results of the discovery phase. This involves assembling instructional templates (e.g., identity, responsibility, and authority boundaries) with runtime-discovered data, which is a form of dynamic context and instruction generation.
- Evidence: The 'Compiler prompt blocks' in references/expert-mechanics.md (e.g., [X0 CORE] through [X7 EXIT]) are used to dynamically configure the behavior and permissions of specialists at runtime.
Audit Metadata