review-clear-blocked
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input provided via the
<rationale>argument and writes it verbatim to local project files (.cocoplus/lifecycle/review-state.jsonandlifecycle/audit.md). This creates an attack surface where malicious instructions could be persisted in the project's state, potentially influencing the agent's behavior during subsequent reads of these files. - Ingestion points: The
<rationale>argument in the$review clear-blockedcommand. - Boundary markers: The instructions do not define delimiters or specific safety warnings to isolate the rationale text from the rest of the file content.
- Capability inventory: The skill has permissions to read and modify files within the
.cocoplus/directory. - Sanitization: There is no evidence of input validation, escaping, or sanitization before the rationale is written to the audit trail or the JSON state file.
Audit Metadata