architecture-decision
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection syntax to execute a local bash script for configuration resolution when the skill is initialized. Evidence:
!bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys ...in SKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project documents which presents a vulnerability surface for instruction injection. 1. Ingestion points: Reads content from docs/architecture/.md, design/gdd/.md, production/epics/**/*.md, and docs/registry/architecture.yaml (referenced in references/3-gather-context.md and references/0-accept.md). 2. Boundary markers: Absent; ingested content is not enclosed in delimiters. 3. Capability inventory: Execution of subprocesses via the Bash tool, file modifications via the Write and Edit tools, and sub-agent delegation via the Agent tool. 4. Sanitization: Absent.
- [COMMAND_EXECUTION]: The skill is configured to execute specific local utility commands and maintenance scripts. Evidence: Bash calls for wc -c, yaml-helper.sh, and registry.sh in the allowed-tools configuration.
Audit Metadata