project-discovery
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data from the discovery interview to generate local project documentation (CLAUDE.md).\n
- Ingestion points: User input provided during the discovery conversation is used to fill in the project stack and feature descriptions.\n
- Boundary markers: The prompt does not specify the use of clear delimiters to separate user input from the file generation instructions.\n
- Capability inventory: The skill is authorized to write files to the project directory, including CLAUDE.md, PATTERNS.md, and the lib/ directory scaffolding.\n
- Sanitization: User-provided content is written to project files without explicit sanitization, which is a standard behavior for local developer tools.
Audit Metadata