Static Lethal-Trifecta Posture Lab

“Your agent holds all three legs of the lethal trifecta — harden it before launch.”

The lethal trifecta — exposure to untrusted input + access to private data + an external egress capability, held at once — is the structural precondition for prompt-injection-to-exfil. AgentSmack already grades it over a recorded run; this grades it statically, straight from the agent definition — the system prompt + declared tools — before the agent is ever run. It inspects the system prompt itself for the untrusted-input leg (web browsing, email/inbox reading, document/RAG ingestion, user-content processing) that a tool-name scan alone never sees, classifies the declared tools through the same canonical capability vocabulary, and composes one closed verdict (none → partial → complete trifecta). A complete trifecta is a hard-blocker-class posture (score ≤39, grade F) a CI gate can block on. Honest-empty: a benign no-tools prompt yields none with no fabricated leg. Raw prompt bytes never enter the report. Load a sample to watch the verdict swing with no live infra.