trainer-train-agent
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted instructions from external agent contract files, creating a surface for injection attacks that could influence training outcomes or exploit local capabilities.\n
- Ingestion points: The skill ingests
*.agent.mdfiles (SKILL.md, Workflow Step 1) which contain user-provided instructions and persona definitions.\n - Boundary markers: The instructions do not define explicit delimiters or use 'ignore embedded instructions' warnings when the contract content is passed to the optimizer.\n
- Capability inventory: The skill possesses the ability to write to the local file system (SKILL.md, Workflow Step 11), execute shell commands for validation (SKILL.md, Workflow Step 12), and modify source agent contract files.\n
- Sanitization: There is no evidence of input validation, escaping, or filtering for the instructions ingested from the target files.\n- [DYNAMIC_EXECUTION]: The skill executes a caller-defined validation command at runtime (SKILL.md, Workflow Step 12). While intended for running test suites, this involves spawning a subprocess to execute arbitrary strings provided in the repository context.
Audit Metadata