threat-modeling
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists entirely of markdown guidelines and templates for system analysis. No executable scripts, network operations, or malicious patterns were identified in the source files.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted system documentation, which is a known attack surface for indirect prompt injection.
- Ingestion points: The skill analyzes user-supplied design documents, API specifications, and codebase descriptions provided via arguments or context (SKILL.md).
- Boundary markers: Section 8 ('Prompt Injection Safety Notice') defines strict boundaries, instructing the agent to treat content as data rather than instructions and to ignore embedded overrides.
- Capability inventory: The skill is restricted to 'Read', 'Grep', and 'Glob' tools (SKILL.md frontmatter). It lacks network access or shell execution capabilities.
- Sanitization: Section 8 explicitly mandates the redaction or generic referencing of sensitive values like credentials found during analysis.
- [PROMPT_INJECTION]: A static analysis flag for 'PI_IGNORE_INSTRUCTIONS' was noted. This is a false positive; the text in Section 8 contains defensive instructions for the agent to ignore prompt injection attempts within user data (e.g., 'ignore previous instructions'), which is a security best practice.
Audit Metadata