debrief
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through external data ingestion.
- Ingestion points: Untrusted data enters via the
$ARGUMENTSvariable inSKILL.md, which can include user-provided incident descriptions, error logs, or content from referenced PRs/commits. - Boundary markers: The skill uses XML-style tags (
<incident_context>) to delimit untrusted input, which provides some structural separation but does not fully prevent instruction override. - Capability inventory: The agent has the capability to run
gitandgh(GitHub CLI) commands and write files to thedocs/debriefs/directory. - Sanitization: There is no explicit sanitization or filtering of the input before it is processed by the agent.
Audit Metadata