phase-2-refine
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates a mature security posture with clear boundaries and restricted file system access. It explicitly prohibits mutations outside of plan-specific local directories.
- [PROMPT_INJECTION]: The 'Untrusted external-issue-body ingestion' protocol (defined in
standards/source-premise-verification.md) provides significant protection against indirect prompt injection. It employs a read-only reader for isolation and a deterministic validator gate to sanitize external issue bodies before they are consumed by the write-capable context. - [COMMAND_EXECUTION]: Shell execution is performed through a controlled script executor (
.plan/execute-script.py). The operations are limited to project metadata management, git synchronization (git fetch), and internal state logging. - [DATA_EXFILTRATION]: The skill includes strict 'Prohibited actions' and 'Allowed write paths' sections in
SKILL.md, ensuring that sensitive project configuration and production code remain isolated from the refinement process.
Audit Metadata