dev1-start
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources including the
$ARGUMENTSvariable (user-provided feature description) and project-level files such asCLAUDE.mdor.claude/CLAUDE.md. These files are explicitly read to gather "project-specific instructions and context," which could be used to influence or override agent behavior if they contain malicious instructions. - Ingestion points:
SKILL.md(via$ARGUMENTS), project root (viaCLAUDE.md,package.json,Cargo.toml,go.mod). - Boundary markers: None present; external content is written directly into
.llm/<feature_name>/tmp_context.mdand processed as context. - Capability inventory: Directory creation, file read, and file write operations within the local workspace.
- Sanitization: No sanitization or validation of the input content is performed before writing to the context files.
- [DATA_EXPOSURE]: The skill performs high-level exploration of the project codebase, which includes reading dependency manifests (
package.json,Cargo.toml,go.mod) and mapping the directory structure. While this is the intended purpose of the tool, it involves systematic access to project metadata.
Audit Metadata