dev2-design
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes data from external files (
tmp_context.mdandtmp_exploration.md) which may contain untrusted content from the user's codebase. - Ingestion points: Files located at
.llm/$ARGUMENTS/tmp_context.mdand.llm/$ARGUMENTS/tmp_exploration.md. - Boundary markers: The skill does not use delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: The skill has the ability to read and write files within the
.llmdirectory and invoke subsequent workflow steps (/dev3-prd). - Sanitization: No sanitization or filtering is performed on the ingested content before it is processed by the agent.
- [PROMPT_INJECTION]: The skill uses user-supplied input ($ARGUMENTS) directly to construct file system paths (e.g.,
.llm/$ARGUMENTS/design.md). This lacks validation and could potentially be exploited via directory traversal sequences (e.g.,../) to influence file access or creation outside the intended directory.
Audit Metadata