ask-matt
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents workflows designed to ingest and act upon untrusted data from external sources.
- Ingestion points: The
/triageflow is designed to handle bug reports and feature requests created by others, and the/researchflow reads from external "primary sources" as described inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or instructions to the model to disregard potentially malicious commands within the ingested data.
- Capability inventory: The ecosystem includes powerful capabilities such as file system writes via
/implementand secret management through/wizard. - Sanitization: There is no mention of sanitizing or validating external input before it is processed by the agent.
- [DYNAMIC_EXECUTION]: The skill describes a tool that dynamically generates executable content.
- Evidence: As noted in
SKILL.md, the/wizardskill "generates an interactive bash script" used for provisioning and credential setup. Generating shell scripts from model output for execution is a dynamic execution pattern that carries inherent risks of unintended command generation.
Audit Metadata