story-readiness
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from various project files, creating an attack surface where malicious data could influence agent logic.
- Ingestion points: Reads story files, ADRs, and architectural registries from the project workspace.
- Boundary markers: Absent. The skill lacks explicit delimiters or instructions to ignore potential commands embedded in the documents it evaluates.
- Capability inventory: The skill can execute local bash scripts and delegate review tasks to a 'qa-lead' agent.
- Sanitization: Absent. Content extracted from markdown files is used directly in logic checks and tool arguments without validation.
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the '!' syntax to trigger a shell command when the skill is loaded.
- Evidence: Uses a bash call to 'yaml-helper.sh' to resolve configuration keys during initialization.
- Description: This mechanism executes code automatically at load-time; while currently used for static config resolution, it represents a pre-execution hook.
- [COMMAND_EXECUTION]: The skill invokes local bash scripts using arguments derived from user input.
- Evidence: Calls 'story-facts.sh' with paths and granularity levels specified by the user.
- Description: The 'allowed-tools' definition uses wildcards for arguments, which could be vulnerable to argument injection if the agent is manipulated into passing malicious flags.
Audit Metadata