stelow-workflow-scope-executor
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted project plans containing instructions that are directly passed to subagents. * Ingestion points: Reads plan documents from docs/{YYYY-MM-DD}/{slug}/plans/spec-tech_{v}.md. * Boundary markers: While the skill uses structural tags like [SCOPE-N] for parsing, it does not apply strict safety delimiters or instructions for subagents to ignore embedded prompts when delegating tasks. * Capability inventory: Uses subagent delegation, node -e execution, and git commands. * Sanitization: No explicit sanitization or filtering of external plan content is performed before interpolation into task strings.
- [DYNAMIC_EXECUTION]: The skill frequently uses node -e to execute inline JavaScript for managing the stelow.json state file and synchronizing data. Additionally, the fallback script dynamically loads modules using require() with paths computed from environment variables and package discovery logic.
- [COMMAND_EXECUTION]: The skill executes various shell commands, including git rev-parse, git diff, and node, to track file footprints and manage the workflow lifecycle.
- [EXTERNAL_DOWNLOADS]: The skill depends on the @calionauta/stelow package for its state management and parsing logic. This represents a vendor-managed resource provided by the author.
Audit Metadata