create-epics
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several local bash scripts (e.g.,
yaml-helper.sh,gdd-structure-check.sh,adr-status.sh,md-section.sh,write-guard.sh) to process local markdown and YAML files. These are limited to the skill's own directory structure and are used for parsing project configuration, checking document status, and enforcing write protections. - [DYNAMIC_CONTEXT_INJECTION]: The skill uses a dynamic command
!bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config ...at load time. This is used to resolve project-specific configuration (review modes, automation settings) from the local environment to adjust the skill's behavior. This is a standard pattern for context-aware developer tools in this environment. - [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill reads sensitive-looking files like
project.yamlanddocs/architecture/tr-registry.yaml, these are part of the game design project context. The data is used internally to generate epic documentation and is not transmitted to external domains. - [PRIVILEGE_ESCALATION]: The skill uses
write-guard.shwith anoverwriteargument. However, the logic explicitly requires a user prompt before any write operation occurs and uses the guard to detect pre-existing files, which is a defensive measure rather than an escalation of privileges.
Audit Metadata