duck-grill
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest untrusted data from the repository (source code, ADRs, and documentation) and use it to challenge user assumptions. This creates a surface for indirect prompt injection where malicious instructions embedded in the repository could influence the agent's behavior.
- Ingestion points: The skill explicitly reads from
CONTEXT.md,CONTEXT-MAP.md,docs/adr/, and repository source code to ground its interrogation (SKILL.md). - Boundary markers: The instructions do not define explicit delimiters or 'ignore instructions' warnings when interpolating repository content into the agent's context.
- Capability inventory: The skill can propose modifications to documentation files like
CONTEXT.mdand ADRs using templates (ADR-FORMAT.md,CONTEXT-FORMAT.md). However, it requires explicit user approval for these semantic changes and limits updates to 2 files per cycle (SKILL.md). No network or shell execution capabilities were detected. - Sanitization: There is no evidence of sanitization or escaping of the content read from external files before it is processed by the agent.
Audit Metadata