pm
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from local project files, which serves as a vulnerability surface for instructions embedded in data.
- Ingestion points: The 'Session Start Protocol' directs the agent to read
docs/memory/,TASK.md, andKNOWLEDGE.mdat the start of a session. - Boundary markers: No delimiters or specific instructions to disregard embedded commands are present to protect the agent's context from poisoned data.
- Capability inventory: The instructions include using
TodoWritefor task management; no tools for shell execution, network exfiltration, or privileged file system access are explicitly requested. - Sanitization: The skill does not implement any validation or sanitization of the content retrieved from the project files.
Audit Metadata