implementation-plan
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions suggest that users or agents install companion skills from an external GitHub repository (mattpocock/skills) using the
npxcommand. This involves downloading and executing code from a source outside of the verified trusted organizations list. - [PROMPT_INJECTION]: The skill is designed to read and interpret various project files, including task definitions, feature specifications, and technical designs. This creates an attack surface for indirect prompt injection, where malicious instructions embedded in these files could potentially influence the agent's behavior.
- Ingestion points: .waypoint/local.yaml, feature.md, task.md, and other local repository documentation.
- Boundary markers: The skill does not define specific delimiters or instructions to isolate untrusted data from the agent's core logic.
- Capability inventory: The skill is limited to reading repository files and generating markdown documentation; it does not possess direct tools for system command execution or network exfiltration.
- Sanitization: No specific sanitization or validation of ingested content is described.
Audit Metadata