sdlc-design
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script,
scripts/fingerprint.py, usingpython3to calculate SHA-256 digests of specification files. The execution is limited to a local utility provided with the skill and operates on paths relative to the skill installation and product repository.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external intent and context documents. To manage the risk of untrusted data influencing agent behavior, the skill mandates a 'Confidence and challenge' framework. This requires the agent to verify assumptions, use a 'challenger' role for unresolved uncertainties, and obtain human or high-confidence autonomous approval before marking documents as specified.
Audit Metadata