run-astro-audit
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture includes a workflow for harvesting external feedback and automatically translating it into executable missions for autonomous subagents. This design presents an indirect prompt injection surface.
- Ingestion points: The script 'scripts/review-harvest.sh' and the protocol in 'references/orchestration/review-feedback-ingestion.md' describe harvesting code-review comments from GitHub Pull Requests to triage findings and dispatch follow-up remediation rounds.
- Boundary markers: The guidance for generating mission-style subagent prompts in 'references/orchestration/subagent-mission-prompting.md' does not implement delimiters or explicit instructions to ignore potentially malicious embedded commands within the harvested feedback.
- Capability inventory: According to the prompting engine specifications, subagents are granted high-privilege capabilities including 'run_command' (shell access), 'replace_file_content' (source code modification), and 'write_to_file' (creating new executables or configs).
- Sanitization: The 'review-feedback-ingestion.md' protocol classifies feedback but lacks a sanitization or filtering phase for the content of the comments before they are used to drive the 'P1: Blocking Defect' remediation logic.
Audit Metadata