takeover
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process data from external, untrusted sources such as Pull Requests, git branches, and conversation threads, creating a surface for indirect prompt injection.
- Ingestion points: The instructions require the agent to read source PR, branch, or thread content (SKILL.md).
- Boundary markers: There are no explicit delimiters or instructions defined to isolate the external data from the agent's core instructions.
- Capability inventory: The agent utilizes tools for code architecture updates (modernize) and Pull Request operations (file-pr, babysit-pr).
- Sanitization: The skill does not mention sanitizing, escaping, or validating the content inherited from external sources.
Audit Metadata