crew-delivery
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a complex workflow where agents (PM, Developer, Reviewer) ingest potentially untrusted data to perform file operations and code execution.\n
- Ingestion points: The PM role processes user requests to create specs and tickets in
SKILL.md. The Developer role ingests these tickets and repository code to implement features. The Reviewer role analyzes code diffs.\n - Boundary markers: The workflow uses separate Git worktrees and branches to isolate tasks, but the instructions do not specify the use of delimiters or 'ignore' instructions for the sub-skills to prevent data-driven instruction overrides.\n
- Capability inventory: The skill instructs agents to perform Git operations (
worktree,rebase,merge) and execute shell commands to run the repository's test suite, providing a vector for code execution if malicious instructions are processed.\n - Sanitization: There are no instructions for sanitizing or validating the input data before it is processed by the various roles.\n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands, specifically Git operations and the repository's test suite, as part of the normal development lifecycle. While these are standard developer actions, they represent a capability that could be abused if the input data is compromised.
Audit Metadata