loopscrum
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting data from repository files to determine its next actions and verify task completion.
- Ingestion points: The agent reads from
goal.md,active-task.md, and other ledger files to build its working context as described inSKILL.mdandreferences/operating-model.md. - Boundary markers: The instructions establish 'coordination boundaries' for multi-writer environments and 'approval boundaries' that require explicit maintainer authorization for irreversible or sensitive acts.
- Capability inventory: The skill possesses the capability to execute local scripts and shell commands, specifically 'proof' commands stored within the work ledger rows.
- Sanitization: While the workflow relies on repository truth and human checkpoints, it lacks specific technical details on how it sanitizes injected commands or prevents the execution of malicious instructions embedded in file-based ledgers.
Audit Metadata