crop-yield

Pass

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external codebases without sufficient isolation or boundary enforcement.
  • Ingestion points: The skill reads the entire target codebase provided via the $ARGUMENTS parameter to perform architecture discovery and model analysis (Phases 1-5).
  • Boundary markers: The instructions do not employ delimiters (e.g., XML tags) or specific prompts to instruct the agent to ignore any natural language instructions that might be embedded within the audited files.
  • Capability inventory: The agent has capabilities to perform recursive filesystem reads and write telemetry data to the local disk.
  • Sanitization: No sanitization or validation of the content read from the target codebase is performed before the agent processes it for the assessment report.
  • [COMMAND_EXECUTION]: The skill automates filesystem operations to record execution metadata. It explicitly checks for the existence of a project memory directory at ~/.claude/projects/ and appends telemetry logs to skill-telemetry.md. While used for self-evolution and performance tracking, this involves persistent write access to a hidden directory in the user's home path.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 23, 2026, 10:56 AM
Security Audit — agent-trust-hub — crop-yield