orch-build-mvp
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external design documents (SDD/PRD) which are used to drive the code generation and build process. 1. Ingestion points: The skill accepts a file path to a design document as its primary input (e.g., civicpulse/docs/SDD-v0.6.md). 2. Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are specified for the document processing. 3. Capability inventory: The skill has the capability to scaffold projects, execute build commands via /gan-build, and commit code (feat: commits). 4. Sanitization: There is no evidence of sanitization or validation for the content of the design documents before they are used to generate the build specifications and test rubrics.
- [COMMAND_EXECUTION]: The skill executes external tools such as orch-pipeline and /gan-build. The /gan-build command runs a generator-evaluator loop that can include UI testing (Playwright) or code execution, with its behavior dictated by the content of the processed design documents.
Audit Metadata