close-milestone
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project documentation and task descriptions to verify milestone completion, which represents a surface for indirect prompt injection. This is a standard functional requirement for milestone review. * Ingestion points: Reads documents such as docs/specifications/product.md, AGENTS.md, and CONTEXT.md. * Boundary markers: No explicit instruction delimiters or boundary markers are defined. * Capability inventory: The agent is instructed to run repository-defined aggregate checks (tests, builds, migrations) and perform file system writes for review reports. * Sanitization: No explicit content sanitization or filtering is described.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a suite of repository-defined verification commands (e.g., builds, tests, security audits) to satisfy completion criteria. This is a legitimate functional capability for its stated purpose.
Audit Metadata