review
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The YAML frontmatter identifies the author as "CocoPlus", which is inconsistent with the expected author context of "snowflake-labs". Deceptive metadata can be used to misrepresent the origin or purpose of a skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple files (e.g., plan.md, discuss.md, quality findings) and uses this content to generate reports and make state-change decisions (approval). The lack of sanitization or boundary markers creates a surface for indirect prompt injection.\n
- Ingestion points: Reads from
.cocoplus/quality-findings-*.md,.cocoplus/grove/cupper-findings.md,plan.md,discuss.md, and various implementation artifacts.\n - Boundary markers: Absent. The skill does not use delimiters or instructions to ensure the agent ignores embedded commands in the ingested data.\n
- Capability inventory: The skill has the ability to write files (
.cocoplus/lifecycle/review.md,.cocoplus/lifecycle/meta.json,AGENTS.md) and execute Git commands (git add,git commit).\n - Sanitization: Absent. Ingested data is extracted and placed directly into the review report.
Audit Metadata