decision-eval

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs architectural analysis on local files within defined project directories. It does not utilize network access, access sensitive system credentials, or employ obfuscation techniques.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external architectural documents which may contain untrusted content that could influence the sub-agent's scoring behavior.
  • Ingestion points: Content is read from docs/decisions/ADR-*.md, docs/architecture/ARCH-*.md, and .great_cto/PROJECT.md.
  • Boundary markers: Absent. The file path is passed directly as context to the decision-scorer agent without specific delimiters or isolation instructions.
  • Capability inventory: The skill uses Read, Glob, Bash (for file identification and variant counting), and Agent (to spawn the scorer).
  • Sanitization: No explicit sanitization or filtering is performed on the content of the design documents before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 11:21 PM
Security Audit — agent-trust-hub — decision-eval