requirements-yaml

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a utility script scripts/check.mjs that executes the git command via execFileSync. It uses git rev-parse --show-toplevel to determine the repository root and git grep to identify requirement IDs (e.g., ACC-01) within project files. This functionality is used to generate reports on whether requirements are covered in the codebase.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local project data, including the requirements.yaml file and the source code found via git.
  • Ingestion points: The agent reads the user's requirements.yaml and all repository files via git grep.
  • Boundary markers: The script does not utilize explicit boundary markers in its output to differentiate project data from agent instructions.
  • Capability inventory: The skill has the ability to read local files and execute the git command-line tool.
  • Sanitization: Data is validated against strict regular expression patterns (PREFIX-NN) before being processed, which limits the potential for instruction injection.
  • [EXTERNAL_DOWNLOADS]: The documentation links to requirements.template.yaml and requirements.schema.json hosted on the author's GitHub repository. These are provided as developer aids for project initialization and IDE support.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 06:50 AM
Security Audit — agent-trust-hub — requirements-yaml