studio-develop-refactor-build
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses
docs/REFACTOR.mdas the source of truth for its operations. This creates an attack surface where instructions embedded in the plan file could influence the agent to perform unintended actions. - Ingestion points: The agent reads
docs/REFACTOR.md,docs/PRD.md, anddocs/DESIGN.md(referenced in SKILL.md). - Boundary markers: The instructions do not define specific delimiters to separate or ignore potentially malicious content within the input files.
- Capability inventory: The skill allows for codebase modification, execution of the application and test suites, and pushing changes to the remote repository.
- Sanitization: No sanitization or validation of the input files is specified before processing.
- [COMMAND_EXECUTION]: The instructions require the agent to run the application and the project's test suite to verify changes. This executes code within the local environment, which is expected behavior for a software development tool.
Audit Metadata