zenf-project
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to capture and persist user-defined task metadata.
- Ingestion points: User input is used to define task attributes such as
title,acceptance_criteria, andverification_commands(SKILL.md, Step 4). - Boundary markers: The instructions do not define safety boundaries or delimiters to isolate user-provided text from the agent's logic during the creation process.
- Capability inventory: The skill utilizes MCP tools (
projects,plans,tasks,search) and HTTP API endpoints (POST /api/v1/tasks) to write this untrusted data to the project database (SKILL.md). - Sanitization: There is no requirement to validate, escape, or sanitize shell commands provided in the
verification_commandsfield, which may be executed by downstream workers.
Audit Metadata