task-brief-creator-caveman
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands including
python3,git,rg, andglob. These are used for repository exploration in Stage 3 and brief validation in Stage 5. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests untrusted data (planning notes, PRDs, and repository files) and interpolates this data into an implementation plan meant for execution by a downstream agent. Ingestion points: Untrusted data enters the context during Stage 1 (input analysis), Stage 3 (codebase review), and Stage 4 (user decision table). Boundary markers: The skill contains explicit instructions to treat user-supplied strings as data and quote them verbatim in the final document to maintain separation. Capability inventory: The skill can execute shell commands via Python and spawn sub-agents for verification purposes. Sanitization: The workflow includes a structural validator (
scripts/validate_brief.py) that checks for template conformity and path existence before the brief is finalized. - [DYNAMIC_EXECUTION]: The workflow involves executing local Python scripts (
validate_brief.py) whose paths are determined at runtime based on the skill's installation directory. While the scripts are packaged with the skill, dynamic command construction is noted. - [SAFE]: The skill uses a 'Stage 4' ownership pass to collect remaining user-owned decisions into a Markdown table, ensuring that the user reviews and locks product intent and scope boundaries before any code execution plan is saved.
Audit Metadata