dx-refactor-discover
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local codebase and version control history, which introduces an attack surface for indirect prompt injection if malicious instructions are embedded in comments or code.
- Ingestion points: The skill reads file content across the project tree (via
Exploresubagents) and extracts metadata from the git history usinggit log --oneline. - Boundary markers: The instructions do not define specific delimiters or guardrails to ensure that content read from the codebase is treated strictly as data, increasing the risk that the agent could obey instructions found within the scanned files.
- Capability inventory: The skill can perform file system writes to create refactor containers (
context/changes/), trigger other internal skills (dx-references,dx-init,dx-standards-update,dx-new,dx-roadmap), and delegate tasks to subagents. - Sanitization: There is no evidence of sanitization or filtering applied to the codebase content before it is processed by the agent or incorporated into the design briefs for subagents.
Audit Metadata