changeset
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of a 'settled solution' or 'direction' to generate a file impact tree. This creates a surface where malicious instructions embedded in the input could attempt to influence the resulting plan.
- Ingestion points: Processes external solution directions and constraints as specified in the Domain Rubric.
- Boundary markers: The protocol lacks explicit delimiters or instructions to treat input data as non-executable text.
- Capability inventory: While the skill itself is configured to be read-only via 'disable-model-invocation: true' and explicit instructions, it routes results to implementation commands like '/forge' which may possess write capabilities.
- Sanitization: No sanitization or validation logic is defined for the input content.
- [SAFE]: The skill includes strong negative constraints, explicitly instructing the agent to 'halt without filesystem mutations' and 'keep planning read-only'.
- [SAFE]: No evidence of credential harvesting, network exfiltration, or unauthorized command execution was found in the instructions.
Audit Metadata