cs-feat-design-review
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions specify reading from
~/.paseo/orchestration-preferences.json. Accessing hidden files in a user's home directory is a data exposure risk, as these files often contain sensitive tool configurations or metadata.\n- [REMOTE_CODE_EXECUTION]: The skill implements a delegation pattern where it spawns and orchestrates sub-agents usingmcp__paseo__create_agentor native agent capabilities. It passes specific prompts and file paths to these sub-agents, creating a multi-agent execution chain based on local file content.\n- [COMMAND_EXECUTION]: The skill programmatically invokes themcp__paseo__create_agenttool to manage secondary AI agents during the design review process.\n- [PROMPT_INJECTION]: The skill processes untrusted external data from project documents, creating a vulnerability to indirect prompt injection attacks.\n - Ingestion points: File content from
.codestable/features/, requirement documents, and architecture documents.\n - Boundary markers: Absent. The instructions do not define delimiters or specific warnings to ignore instructions embedded within the files being reviewed.\n
- Capability inventory: The skill can spawn sub-agents, read arbitrary project code, and write review reports to the filesystem.\n
- Sanitization: Absent. The skill reads and processes the content of external documents without validation or filtering.
Audit Metadata