reflect
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from conversation history to derive rules for file modification. This creates a surface where an attacker could inject content into a conversation to trick the agent into suggesting harmful rules. However, the process is gated by human review.\n
- Ingestion points: Conversation history (SKILL.md, Step 1).\n
- Boundary markers: Absent in instructions, though the human-in-the-loop check in Step 5 provides a manual boundary.\n
- Capability inventory: File writing in the current repository and the vendor-specific directory
~/dev/src/github.com/Zihad550/skills, and execution of validation scripts.\n - Sanitization: No specific sanitization of the conversation history is performed.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute check-scripts from the repository (e.g.,
.agents/scripts/check-diff.py) to verify that newly created rules correctly identify mistakes in the code.
Audit Metadata