arena
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE]: The skill reads from
~/.cursor/rules/pstack-models.mdcto determine model configurations and cross-judge pools. This is a configuration file within the user's local IDE environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes and merges output from multiple subagents ('candidates'). This creates a surface where instructions generated by a subagent could influence the main agent's behavior during the grafting phase.
- Ingestion points: Reads candidate output files from
/tmp/arena-<slug>/or git worktrees. - Boundary markers: No explicit boundary markers or 'ignore' instructions are used when reading candidate outputs.
- Capability inventory: The skill has the ability to spawn subagents and write to the local filesystem.
- Sanitization: The skill mitigates this risk by instructing the user/agent to 'fold each graft in by hand' and 'don't paste mechanically', encouraging manual review during synthesis.
Audit Metadata