sast-idor
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection by ingesting untrusted source code and interpolating it into instructions for parallel sub-agents during the verification phase.
- Ingestion points: The Recon phase scans a codebase and writes findings to
sast/idor-recon.md, which are then used to build prompts for Verify sub-agents. - Boundary markers: The instructions for the Verify sub-agents lack explicit delimiters or instructions to ignore embedded commands within the pasted candidate code snippets.
- Capability inventory: The agent can write to the local filesystem (sast/*.md) and launch sub-agents with specific prompts.
- Sanitization: No explicit sanitization or escaping of the code snippets is mentioned before they are included in the sub-agent instructions.
Audit Metadata