debug-mode
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to read and evaluate NDJSON records from a
LOG_FILEto identify bug causes. If the target application logs untrusted data, the agent may be exposed to malicious instructions embedded in those logs. - Ingestion points: Application log records are ingested via
LOG_FILEas described inreferences/prove-fix-verify.md. - Boundary markers: Attempt boundaries are tracked using
ATTEMPT_START_LINE, but there are no instructions to treat the log content itself as untrusted or to sanitize it for agent instructions. - Capability inventory: The agent is authorized to perform code modifications and run repository checks, providing a high-impact target for successful injection.
- Sanitization: Guidelines in
references/probes.mdsuggest redacting sensitive data, which reduces data exposure but does not prevent prompt injection. - [DATA_EXFILTRATION]: The workflow involves modifying code to send runtime state to an external
LOG_SERVER_URL. This creates a network-based exfiltration path for any data captured by the instrumentation probes.
Audit Metadata