ask-imogen
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (developer messages) and reads external files (
repo-map.md,docs/repo-map.md) to determine which downstream skills to execute and how to answer codebase questions. - Ingestion points: Processes dev messages like "client wants a feature" or "something broke" in SKILL.md. Reads
repo-map.mdfiles from the workspace or localdocs/folder. - Boundary markers: Lacks explicit delimiters for the
repo-map.mdcontent, although it includes a verification step where it checks the map against the actual code. - Capability inventory: Has the ability to run other skills (e.g.,
prd-writer,impact-analysis,django-feature) and perform code searches and file reads. - Sanitization: The skill includes a 'Rule' requiring a "go-ahead" from the user before running any suggested chain of skills, which serves as a human-in-the-loop safety checkpoint to mitigate automated injection attacks.
Audit Metadata