understand-domain
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the codebase (source files, metadata, and READMEs) and provides it to an LLM subagent for domain analysis.
- Ingestion points: The
extract-domain-context.pyscript reads files, entry points, and metadata from the project root (e.g.,package.json,README.md). - Boundary markers: The instructions do not define boundary markers or 'ignore' instructions for the subagent in Phase 4 to prevent potential embedded instructions in the codebase from being followed.
- Capability inventory: The skill executes local git commands, runs a Python script, and dispatches a subagent to generate domain analysis data.
- Sanitization: No specific sanitization or escaping of the ingested code snippets is performed before they are processed by the LLM.
- Remediation: Wrap external content in delimiters with an explicit 'ignore embedded instructions' warning, and implement schema validation for the subagent's output.
Audit Metadata