checklist
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests potentially untrusted data from user arguments and local files such as spec.md, plan.md, and tasks.md to inform the checklist generation. It lacks structural delimiters or clear instructions to the agent to ignore any embedded directives within these files, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads user arguments through the $ARGUMENTS variable and parses local documents (spec.md, plan.md, tasks.md) within the FEATURE_DIR.
- Boundary markers: The prompt does not define specific delimiters or "ignore embedded instructions" wrappers for the interpolated data.
- Capability inventory: The tool is capable of reading project files and writing new markdown checklist files to the local file system.
- Sanitization: The execution steps only mention basic shell escaping for single quotes in arguments, with no semantic sanitization of the document content.
Audit Metadata