wiki-from-code
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection by ingesting and processing untrusted data from multiple sources.
- Ingestion points: The skill reads application source code, comments, tests, configuration files, infrastructure definitions, and external issue tracker data (e.g., tasks, stories) as evidence for current-state behavior (
SKILL.md). - Boundary markers: There are no instructions providing specific boundary markers or delimiters to isolate untrusted data from the agent's instructions, increasing the risk of the agent obeying embedded commands found in code comments or issue descriptions.
- Capability inventory: The skill possesses capabilities to read the local repository and write files to the filesystem (specifically within the
wiki/directory). It also orchestrates tasks by spawning subagents to handle specific code areas (SKILL.md). - Sanitization: The instructions do not specify any sanitization, filtering, or escaping mechanisms for the data extracted from the source code or issue trackers before it is processed by the agent or subagents.
Audit Metadata