to-product
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts and shell commands to manage the project environment as part of its automation logic.\n
- Evidence: The command
node scripts/validate-project.mjsis executed during the preflight phase inSKILL.mdto ensure the project baseline is valid.\n - Evidence: The agent autonomously performs git operations including branch inspection, creation, and deletion to manage the delivery workflow.\n- [PROMPT_INJECTION]: The skill processes external inputs like PRD files and user-provided prose, which creates a surface for indirect prompt injection where malicious instructions could be embedded in source documents.\n
- Ingestion points: The agent reads PRD file paths, directories, and inline strings as described in the
SKILL.mdInputs section.\n - Boundary markers: The instructions lack explicit delimiters or 'ignore embedded instructions' warnings for the data being processed.\n
- Capability inventory: The skill can write transcripts and records to the file system, execute local validation scripts, and perform branch management.\n
- Sanitization: No specific validation or sanitization of the PRD content is mentioned.\n- [DATA_EXFILTRATION]: The skill's 'Autonomous contract' in
references/autonomous-contract.mdincludes a specific safety policy that forbids pushing to remote repositories or publishing data outside the local environment, providing a strong control against unauthorized data exfiltration.
Audit Metadata