tech-debt-map
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill audits codebase modules by reading and quoting local source files.\n
- Ingestion points: In Step 3 ('Sweep'), sub-agents read and quote raw code from user-provided file paths in the local repository.\n
- Boundary markers: The instructions lack specific requirements for using delimiters or 'ignore' instructions when processing external code, which could allow malicious comments in the source to influence the agent.\n
- Capability inventory: The skill identifies and reads files via globs, executes local
git logcommands to analyze history, and writes markdown reports to the filesystem.\n - Sanitization: There are no explicit requirements to sanitize or escape code snippets before they are included in the generated technical debt reports.
Audit Metadata