frontend-decision-sync
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it ingests untrusted data from implementation changes and diffs to update agent-facing instruction files like
AGENTS.md,CLAUDE.md, andGEMINI.md. - Ingestion points: The skill reads the frontend diff, changed frontend files, and existing repository documentation (SKILL.md, Gate 0).
- Boundary markers: There are no explicit instructions to use delimiters or ignore instructions embedded within the code being analyzed, although Gate 1 (Decision Extraction) serves as a manual filtering step.
- Capability inventory: The skill possesses file-read and file-write capabilities across the repository.
- Sanitization: While the skill includes "Guardrails" to prevent inventing rules or promoting one-off workarounds, it lacks technical sanitization to prevent malicious instructions embedded in code comments from being extracted as legitimate "decisions."
Audit Metadata