pmstudio-changelog
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from local project files that could contain embedded instructions to manipulate the change log generation.
- Ingestion points: The skill reads from
CLAUDE.local.md, theMeeting-Notes/directory, and thePRD/directory to extract change records. - Boundary markers: No explicit boundary markers or 'ignore' instructions are used to separate ingested content from the system instructions.
- Capability inventory: The skill allows for reading filesystem data and writing files to the
Data/directory. No network operations or command execution tools are utilized. - Sanitization: There is no evidence of sanitization or filtering for the extracted text before it is proposed or written to the change log.
- Mitigation: The skill enforces a human-in-the-loop requirement (Step 4 and Rule 2) which mandates that the agent must present proposed entries for user approval ('Accept? [Y/n]') before writing to disk.
Audit Metadata