dev-story
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external, potentially untrusted project data that influences agent behavior.
- Ingestion points: The skill reads content from user-specified story files, architecture decision records (ADRs), and the project's control manifest to define implementation requirements.
- Boundary markers: The instructions do not define clear delimiters or use explicit "ignore embedded instructions" warnings when passing context from these files to sub-agents via the Task tool.
- Capability inventory: The skill possesses powerful capabilities including file writing, shell command execution via Bash, and the ability to spawn and instruct other agents via Task.
- Sanitization: The skill does not perform validation, filtering, or escaping of the content read from external files before it is used to brief programmer agents.
- Mitigation: To reduce risk, ingested content should be wrapped in clear boundary markers (such as XML tags) with explicit instructions to sub-agents to treat the content as data and disregard any embedded commands or directives.
Audit Metadata