pre-1-0-forward-only
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the repository, including
Cargo.toml, README files, source code, and examples. It also possesses the capability to modify these files during an "authorized editing request." The lack of explicit boundary markers or sanitization for interpolated repository content creates a surface for indirect prompt injection, where malicious instructions embedded in project files could influence the agent's behavior during documentation or code refactoring. - Ingestion points: Reads
Cargo.toml, project documentation (READMEs,AGENTS.md), and source code files as specified in the 'Scope Check' and 'Review and Editing Workflow'. - Boundary markers: The instructions do not specify delimiters or warnings for the agent to ignore instructions embedded within the files it is analyzing.
- Capability inventory: The skill is authorized to perform file-write operations, including patching implementation, public exports, tests, and documentation (described in 'Forward-Only API Rule').
- Sanitization: No explicit sanitization or filtering of the ingested file content is mentioned before it is processed or used to generate updates.
Audit Metadata