requirements-yaml
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a utility script
scripts/check.mjsthat executes thegitcommand viaexecFileSync. It usesgit rev-parse --show-toplevelto determine the repository root andgit grepto identify requirement IDs (e.g.,ACC-01) within project files. This functionality is used to generate reports on whether requirements are covered in the codebase. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local project data, including the
requirements.yamlfile and the source code found via git. - Ingestion points: The agent reads the user's
requirements.yamland all repository files viagit grep. - Boundary markers: The script does not utilize explicit boundary markers in its output to differentiate project data from agent instructions.
- Capability inventory: The skill has the ability to read local files and execute the
gitcommand-line tool. - Sanitization: Data is validated against strict regular expression patterns (
PREFIX-NN) before being processed, which limits the potential for instruction injection. - [EXTERNAL_DOWNLOADS]: The documentation links to
requirements.template.yamlandrequirements.schema.jsonhosted on the author's GitHub repository. These are provided as developer aids for project initialization and IDE support.
Audit Metadata