cs-do
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the repository that could contain malicious instructions.
- Ingestion points: The agent is instructed to read various local files including .codestable/INDEX.md, task context packs, lifecycle artifacts (e.g., feature designs, audit ledgers), and the repository source code and tests (SKILL.md Startup scan).
- Boundary markers: No explicit delimiters or instructions are provided to separate the agent's instructions from the content of the files it reads.
- Capability inventory: The skill allows the agent to modify code and execute verification commands (Fixed output protocol 'Checks').
- Sanitization: There is no mechanism described to sanitize or filter ingested content to prevent it from influencing the agent's execution logic.
Audit Metadata