pilot
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from the repository, including source code, documentation, and the results of local scripts, to formulate project plans and design decisions (Rules 1 and 4).
- Ingestion points: Untrusted repository files and CLI tool outputs are read into the agent's context as evidenced in the 'Decision rules' and 'Entry paths' sections.
- Boundary markers: The instructions do not mandate the use of delimiters or 'ignore' markers when the agent processes external file content.
- Capability inventory: The skill possesses the ability to execute shell commands and scripts (Rule 8) and modify files (SPARK.md).
- Sanitization: There is no requirement for the agent to sanitize or validate the content it reads from the repository before using it to influence downstream actions.
- [DYNAMIC_EXECUTION]: Rule 8 explicitly directs the agent to 'check and reuse repository existing commands, scripts and local tools' for evidence gathering. This creates a risk where a malicious repository could contain scripts that the agent is then prompted to execute as part of its normal workflow.
- [COMMAND_EXECUTION]: The skill relies on 'CLI-first' principles (Rule 8) to verify project state, which involves executing arbitrary local commands and tools based on what it finds in the environment.
Audit Metadata