ai-context-layer
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest and process untrusted data from multiple sources, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context through the select and resolve runtime verbs in builds/reference_app/runtime/verbs.py, pulling from document corpora, conversation episodes, and tool results.
- Boundary markers: The skill implements and mandates boundary discipline, such as token-origin tagging in the system prompt to separate instructions from data (references/security-threat-model.md).
- Capability inventory: The system includes capabilities for shell command execution in builds/cookbooks/git_repo_ingest.md, network communication via LLM and database adapters, and persistent file system writes.
- Sanitization: The skill provides patterns for sanitization, including PII scrubbing at ingest and the P17 Schema-grounded write path pattern to validate facts before storage.
- [DYNAMIC_EXECUTION]: The skill uses lazy loading of adapter modules at runtime based on hardcoded mapping.
- Evidence: builds/reference_app/adapters/init.py uses importlib.import_module() to load vendor-specific adapters.
- Context: The module paths are selected from a hardcoded mapping (_LAZY), which is a safe and standard implementation for managing optional dependencies.
- [COMMAND_EXECUTION]: Example implementation code uses subprocess calls for git operations.
- Evidence: builds/cookbooks/git_repo_ingest.md contains a git() helper function that calls subprocess.check_output(['git', ...]).
- Context: The execution is used for local repository management in a tutorial context, using list-based argument passing which is resistant to shell injection.
Audit Metadata