create-epics

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses several local bash scripts (e.g., yaml-helper.sh, gdd-structure-check.sh, adr-status.sh, md-section.sh, write-guard.sh) to process local markdown and YAML files. These are limited to the skill's own directory structure and are used for parsing project configuration, checking document status, and enforcing write protections.
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses a dynamic command !bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config ... at load time. This is used to resolve project-specific configuration (review modes, automation settings) from the local environment to adjust the skill's behavior. This is a standard pattern for context-aware developer tools in this environment.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill reads sensitive-looking files like project.yaml and docs/architecture/tr-registry.yaml, these are part of the game design project context. The data is used internally to generate epic documentation and is not transmitted to external domains.
  • [PRIVILEGE_ESCALATION]: The skill uses write-guard.sh with an overwrite argument. However, the logic explicitly requires a user prompt before any write operation occurs and uses the guard to detect pre-existing files, which is a defensive measure rather than an escalation of privileges.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 10:23 AM