orch-build-mvp
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external design documents (SDDs/PRDs) to plan and scaffold code, creating an attack surface for indirect prompt injection. Instructions within the analyzed document could potentially influence the code generation or the behavior of the build loop.
- Ingestion points: The skill reads external document paths (e.g., civicpulse/docs/SDD-v0.6.md) as specified in the usage instructions.
- Boundary markers: No delimiters or explicit instructions to ignore embedded commands within the ingested documents are described.
- Capability inventory: The skill triggers code scaffolding, executes an automated build/eval loop via /gan-build, and performs automated git commits.
- Sanitization: No sanitization or validation of the input document content is mentioned.
- [COMMAND_EXECUTION]: The skill orchestrates the execution of powerful commands such as /gan-build and manages automated version control commits (feat:). While these are intended for the skill's purpose of MVP development, they represent capabilities that would be executed in response to potentially untrusted input data.
Audit Metadata