usage
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like git log, git rev-parse, and mkdir to gather metadata and manage the local output directory. These commands are used for their intended purpose and do not involve unsafe parameter handling.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes external project data. Ingestion points: The skill reads content from .codevoyant/plans/*/plan.md and git log output in references/workflows/report.md (Step 2), and scans the active conversation context in Step 4. Boundary markers: Instructions do not specify delimiters or ignore-instruction warnings for data extracted from logs or plan files. Capability inventory: The skill can write markdown files to the .codevoyant/usage/ directory. Sanitization: Positional arguments used for filename generation are sanitized using tr -cd 'a-z0-9-' to prevent shell injection or path traversal.
Audit Metadata