st-execute-blueprint
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes project plans and tasks stored as Markdown files in the local repository. 1. Ingestion points: Reads plan documents and task files (.md) from the file system during the execution loop in SKILL.md and scripts/dispatch-task-execution.cjs. 2. Boundary markers: The operating procedure enforces the use of verification gates (verification-gate.md) and anti-rationalization guidelines (anti-rationalization.md) to validate the output of processed data. 3. Capability inventory: The skill can execute shell commands, perform Git operations (branching, commits), and spawn external LLM CLI processes. 4. Sanitization: Task metadata is parsed using a YAML parser (js-yaml), while task bodies are passed to agents for implementation.
- [EXTERNAL_DOWNLOADS]: The skill checks for updates to its core logic by querying the public GitHub API. Evidence: Fetches release metadata from https://api.github.com/repos/e0ipso/strikethroo/releases/latest in scripts/check-for-updates.cjs.
- [COMMAND_EXECUTION]: The skill utilizes system commands to integrate with development environments and delegate tasks. Git Integration: Executes git commands for repository root location, status monitoring, and branch management. Task Dispatch: Orchestrates the execution of tasks by spawning external command-line tools for various AI harnesses including claude, copilot, gemini, codex, cursor-agent, and opencode (scripts/dispatch-task-execution.cjs).
Audit Metadata