brainstorm
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via the
$ARGUMENTSplaceholder (the feature description) and interpolates it directly into a call to another agent (@codebase-review-agent) and into generated documentation. - Ingestion points: The
feature descriptioncaptured from$ARGUMENTSinSKILL.md. - Boundary markers: None. The input is passed directly into a task instruction without delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill has the ability to write files to the local filesystem (
docs/brainstorm/) and invoke other agent skills (@codebase-review-agent,@refine-approach). - Sanitization: No evidence of input sanitization or validation is present before the data is used in prompts.
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the dynamic context injection syntax (
!git rev-parse --abbrev-ref HEAD) inSKILL.mdto identify the current Git branch. This is a benign use for workflow management (offering to create a feature branch), but it demonstrates the use of load-time shell command execution.
Audit Metadata