arena
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The 'arena' workflow involves fanning out tasks to multiple subagents and subsequently reading, judging, and grafting their outputs into a final artifact, which creates a surface for instructions within subagent data to influence the parent agent.
- Ingestion points: In Phase D (Pick a base) and Phase E (Graft), the parent agent is instructed to 'Read every candidate end to end' and 'Walk each losing candidate once more', ingesting rationales and artifacts generated by sub-processes.
- Boundary markers: The instructions lack explicit delimitation or 'ignore embedded instructions' directives for the data retrieved from the subagent-controlled output paths.
- Capability inventory: The skill utilizes subagent spawning (background mode), file system operations (writing to /tmp/arena- or git worktrees), and model configuration access (pstack model config).
- Sanitization: No evidence of sanitization, escaping, or schema validation is present for the content being grafted from candidates into the base artifact.
Audit Metadata