sdlc-doubt
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves processing untrusted technical artifacts and passing them to sub-agents, which creates a surface for indirect prompt injection.\n
- Ingestion points: Technical artifacts (code diffs, SQL, design fragments) are ingested in 'Step 2: EXTRACT' and 'Step 3: DOUBT' as defined in SKILL.md.\n
- Boundary markers: The skill uses 'ARTIFACT:' and 'CONTRACT:' headers as delimiters in the prompt template. While these provide structure, they do not technically prevent an attacker from embedding instructions within the artifact to manipulate the sub-agent.\n
- Capability inventory: The skill utilizes 'Agent tools' to spawn sub-agents (Step 3) and involves potential file-write operations to 'decisions.md' or 'design.md' during the 'RECONCILE' step (Step 4).\n
- Sanitization: No technical sanitization, such as escaping or filtering of special characters or instruction-like patterns, is performed on the ingested artifacts before they are interpolated into the sub-agent's prompt.
Audit Metadata