project-context-ingestion
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted content from the repository, creating a surface for indirect prompt injection. Malicious instructions embedded in build scripts, configuration files, or CI workflows could influence the agent's behavior or subsequent code generation.
- Ingestion points: The skill reads build files (settings.gradle.kts, build.gradle.kts), configuration files (application.yml, application.properties), and CI/deployment manifests (Dockerfile, Kubernetes manifests, CI workflows).
- Boundary markers: The skill does not define clear delimiters or instruction-ignore warnings for the ingested data.
- Capability inventory: The skill performs extensive file reading across the repository to extract mapping data.
- Sanitization: No sanitization or validation of the ingested repository content is mentioned.
- [DATA_EXFILTRATION]: The skill instructions direct the agent to read files that frequently contain sensitive environment variables or configuration secrets.
- Evidence: SKILL.md includes instructions to read .env.example, application.yml, application.properties, CI workflows, and Kubernetes manifests.
Audit Metadata