Development record
Five agent prompts read attacker-influenceable input without the itd-5 contract (ruthless-reviewer, security-reviewer, docs-currency-reviewer, intent-auditor, sota-researcher) and agents/ sits outside both lint roots, so no detector exists for the class; the PQ linter (agents/README.md) is the missing detector
issueresolvedminoriss-278
Five agent prompts read attacker-influenceable input without the itd-5 contract (ruthless-reviewer, security-reviewer, docs-currency-reviewer, intent-auditor, sota-researcher) and agents/ sits outside both lint roots, so no detector exists for the class; the PQ linter (agents/README.md) is the missing detector
Frontmatter
| id | iss-278 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-278-five-agent-prompts-read-attacker.md
open on GitHub ↗ · commit history ↗
References1
- itd-151Five agent prompts read attacker-influenceable input without the itd-5 contract (ruthless-reviewer, security-reviewer, docs-currency-reviewer, intent-auditor, sota-researcher) and agents/ sits outside both lint roots, so no detector exists for the class; the PQ linter (agents/README.md) is the missing detectorrelated
mentions3
- dcn-26081900000000022026-08-19 — Review agents keep their Bash grant: running the project's tests is
- iss-2610151422139704The brief at .abcd/development/brief/05-internals/05-prompt-quality.md:106-108, .abcd/development/brief/05-internals/05-prompt-quality.md:128-129 says: the four review and research prompts enter the changelog at 0.2.0 (the bump that first gave them the untrusted-input contract) The shipped surface differs: The agent changelog entry '0.2.0 — 2026-08-19 (iss-278)' (.abcd/development/agents/CHANGELOG.md:752-791) lists FIVE prompts: ruthless-reviewer, security-reviewer, docs-currency-reviewer, intent-auditor, sota-researcher. The same chapter says 'five prompts hardened on 2026-08-19' at line 119. (v0.14.2 release crosscheck, stale-count, raised by sonnet in a35.)
- itd-5Every Agent Prompt Carries Its Version, Earns Its Lock, And Survives Injection