repository-governance-lifecycle
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute local administrative and helper commands, including a bash script at scripts/next-adr-number.sh to manage ADR numbering, the creation of symbolic links for documentation structure, and a Node.js command-line script for cleaning and base64-encoding brand assets.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes and follows instructions from repository documentation to govern behavior. Ingestion points: Reads references/charter-and-ethics.md, references/north-star-rules.md, and all files in docs/** to establish governance rules. Boundary markers: None identified. Capability inventory: The agent has file system write permissions for ADRs and FAQs, can manage symbolic links, and execute local scripts. Sanitization: None identified; content from documentation files is processed without validation.
Audit Metadata