crop-yield
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external codebases without sufficient isolation or boundary enforcement.
- Ingestion points: The skill reads the entire target codebase provided via the
$ARGUMENTSparameter to perform architecture discovery and model analysis (Phases 1-5). - Boundary markers: The instructions do not employ delimiters (e.g., XML tags) or specific prompts to instruct the agent to ignore any natural language instructions that might be embedded within the audited files.
- Capability inventory: The agent has capabilities to perform recursive filesystem reads and write telemetry data to the local disk.
- Sanitization: No sanitization or validation of the content read from the target codebase is performed before the agent processes it for the assessment report.
- [COMMAND_EXECUTION]: The skill automates filesystem operations to record execution metadata. It explicitly checks for the existence of a project memory directory at
~/.claude/projects/and appends telemetry logs toskill-telemetry.md. While used for self-evolution and performance tracking, this involves persistent write access to a hidden directory in the user's home path.
Audit Metadata