test
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files to drive its testing logic, creating a surface where malicious instructions could be embedded in the repository data.
- Ingestion points: The skill reads content from
tmp/issues/<issue>/checklist.html,tmp/issues/<issue>/implementation-notes.md,research.md, andplan.mdto update its checklist and verify implementation deviations (Steps 2 and 3). - Boundary markers: There are no instructions providing delimiters or 'ignore embedded instructions' warnings for the data read from these files.
- Capability inventory: The skill is granted access to high-privilege tools including
Bash,Write,Edit, and the ability to invoke other skills like/chrome-devtools-cliand/capture. Malicious content in the ingested files could attempt to abuse these tools. - Sanitization: The skill lacks any explicit sanitization or validation logic for the content read from the repository files before it is used to determine testing steps and tool parameters.
Audit Metadata