adversarial-review
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence agent behavior.
- Ingestion points: The skill reads work briefs, plans, investigation outputs, source specifications, tickets, logs, screenshots, and code references as part of the review process (SKILL.md).
- Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands within the ingested engineering artifacts.
- Capability inventory: The skill includes instructions to read and update worker configurations in kickoff.yaml, but lacks capabilities for arbitrary shell execution, network exfiltration, or access to sensitive credential files.
- Sanitization: As a mitigating control, the skill explicitly instructs sub-agents to provide only structured output and forbids them from making implementation changes or spawning additional workers.
Audit Metadata