verification-before-completion
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill employs extremely imperative and absolute language to override the agent's default decision-making and communication style.
- Evidence: Instructions such as "NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE", "Skip any step = lying", and "Honesty is a core value. If you lie, you'll be replaced" use threat-based reinforcement to force adherence.
- Evidence: The skill explicitly restricts the agent's conversational range by banning common positive reinforcements like "Great!" or "Done!" until specific conditions are met, which is a behavioral constraint beyond standard task instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a "Gate Function" that instructs the agent to identify and execute shell commands to prove claims. This creates a vulnerability surface where a malicious actor could embed dangerous commands in data the agent processes (like a README or PR description) and label them as "verification steps".
- Ingestion points: The agent is instructed to "IDENTIFY: What command proves this claim?" from its current workspace or context.
- Boundary markers: Absent. There are no instructions to distinguish between agent-generated verification commands and commands found in external, potentially untrusted data.
- Capability inventory: The skill explicitly requires the agent to "RUN: Execute the FULL command", implying access to shell execution tools or subprocess calls.
- Sanitization: Absent. There is no requirement for the agent to sanitize, validate, or confirm the safety of the identified command before execution.
Audit Metadata