delegate
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core function is to orchestrate implementation by passing user requests directly to a sub-agent worker ("GPT-5.6 Luna"). This architectural pattern creates a surface for indirect prompt injection, where instructions embedded in a user's implementation request could influence the behavior of the worker sub-agent.
- Ingestion points: Untrusted user input enters the execution context through the
$delegatekeyword in the user prompt. - Boundary markers: The instructions for creating the sub-agent prompt do not specify the use of robust boundary markers, such as XML-like tags or explicit delimiters, to separate user-provided content from agent instructions.
- Capability inventory: The worker sub-agent is authorized to perform substantive code and file edits and execute repository validation checks, which could be abused if an injection is successful.
- Sanitization: The skill instructions explicitly direct the orchestrator to reproduce user requests "verbatim" and avoid "paraphrasing, compressing, or omitting" any details, which prevents the parent agent from filtering or sanitizing potentially malicious input before it reaches the worker.
Audit Metadata