how
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the local codebase to generate architectural explanations, creating a surface for indirect prompt injection attacks.
- Ingestion points: Found in
SKILL.md(via subagent task spawning),references/explorer-prompt.md(where explorers directly read source code using tools), andreferences/explainer-prompt.md(where the explainer synthesizes findings from explorers). - Boundary markers: Absent. The instructions and templates do not provide specific delimiters or warnings to the subagents to ignore instructions embedded within the code being analyzed.
- Capability inventory: The skill implements strong mitigations by explicitly setting all subagents to
readonly: true. The authorized tools (Read,Grep,Glob) are restricted to information gathering, with no capabilities for file writing, system modification, or network communication identified. - Sanitization: No explicit sanitization or filtering of the content read from the codebase is performed before it is presented to the synthesizer or the user.
Audit Metadata