dev4-implement
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates user-provided input ($ARGUMENTS) directly into a shell command:
wt switch -c feat/$ARGUMENTS. This creates a risk of shell command injection if the input contains malicious characters such as semicolons, ampersands, or backticks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external files including
prd.mdanddesign.md. This represents an indirect prompt injection surface. - Ingestion points: The skill reads files from the
.llm/$ARGUMENTS/directory into the agent context (SKILL.md). - Boundary markers: No delimiters or explicit warnings to ignore embedded instructions are used when reading these files.
- Capability inventory: The agent has the capability to execute shell commands for git operations and running tests, as well as the ability to write files to the local filesystem.
- Sanitization: There is no evidence of validation or sanitization of the content extracted from the PRD or design documents before the agent acts upon them.
Audit Metadata