retrospective
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests untrusted data from project documents and persists that data into a shared context registry.\n
- Ingestion points: Project documents referenced via
@filesyntax and user-provided descriptions of successes, challenges, and learnings are ingested into the agent context in SKILL.md.\n - Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the content read from
@fileproject documents, allowing potential malicious instructions to be interpreted by the model.\n - Capability inventory: The skill has the capability to write new markdown files and modify persistent registry files (e.g.,
context/learnings/index.mdandcontext/assumptions/registry.md) in SKILL.md.\n - Sanitization: No sanitization, validation, or escaping of external content is specified before the data is interpolated into prompts or saved to the long-term context registry.
Audit Metadata