x9-idea-critic
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted user proposals and external data (repository artifacts, live sources) to generate critiques. This creates a potential surface for indirect prompt injection where malicious instructions could be embedded in the analyzed content.
- Ingestion points: User-provided ideas, cited repository artifacts, and live external sources referenced in the skill instructions.
- Boundary markers: Employs a 'sealed brief' to isolate the critic's task and explicitly instructs the agent not to pass the surrounding conversation to sub-agents.
- Capability inventory: File system read access and network access to fetch live sources; ability to spawn and delegate to fresh agent sessions using vendor tools like x9-codex-delegation.
- Sanitization: No explicit sanitization or filtering of external content is described beyond the structural isolation provided by the brief format.
- [EXTERNAL_DOWNLOADS]: The skill enables the agent to fetch and read content from external live sources and code repositories to verify factual claims during the critique process.
- Evidence: 'A critic making factual claims must be able to read the cited repository artifacts or live sources.'
Audit Metadata