feature-flow
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform local shell commands to manage the git lifecycle, including
git status, staging files, and generating Conventional Commits. It also instructs the agent to provide the user with commands for local script execution, specificallyCI=true ./init.sh. - [INDIRECT_PROMPT_INJECTION]: The orchestration logic relies on reading and processing external documentation and state files, which constitutes a vulnerability surface for indirect instructions.
- Ingestion points: The agent reads data from
feature_list.json,PROGRESS.md, and markdown files withindocs/specs/anddocs/validations/, as well as parsing dynamic handoff context from subagents. - Boundary markers: No explicit delimiters or boundary markers are defined to isolate untrusted file content from the agent's core instructions.
- Capability inventory: The skill possesses the capability to modify local files (status updates, validation records) and perform git commits, which could be triggered by malicious content in the ingested files.
- Sanitization: The skill lacks explicit sanitization or validation routines for the content of the markdown and JSON files it processes before using that data to determine the next workflow step.
Audit Metadata