bare-eval
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill constructs prompts for evaluation and grading by interpolating external data such as skill outputs, assertions, and user prompts. Besides ingestion of external data, the skill provides no mechanisms for escaping or sanitizing these inputs. * Ingestion points: Prompts in references/invocation-patterns.md (e.g., $output_text, $assertions_json, $prompt) ingest data that could contain malicious instructions. * Boundary markers: Data is delimited by simple labels (e.g., OUTPUT:, ASSERTIONS:) which can be easily bypassed by adversarial content within the interpolated variables. * Capability inventory: The skill triggers claude -p commands via the shell and uses a JavaScript workflow (workflows/skill-fitness.js) that can read arbitrary files within the repository using the Read tool. * Sanitization: No sanitization or escaping of the interpolated variables is performed before they are embedded into the prompt strings.
Audit Metadata