project-stage-detect
Warn
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: MEDIUMDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the '!' syntax to execute shell commands during initialization. Specifically, it runs
bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys workflow,automationto load configuration. This execution happens automatically when the skill is loaded by the agent. - [COMMAND_EXECUTION]: The skill requests permission to execute local bash scripts with path traversal (
../../) and broad argument wildcards. Specifically, it allows executingyaml-helper.shandartifact-check.shfrom the project's.claudedirectory. This creates a risk if a user is working in an untrusted project where these scripts could contain malicious code. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by reading untrusted project files. * Ingestion points: design/, src/, production/, prototypes/, docs/architecture/, and tests/ directories. * Boundary markers: None (absent). * Capability inventory: Read, Write, Glob, Grep, and Bash. * Sanitization: None (absent).
Audit Metadata