st-full-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Multiple scripts within the skill utilize child_process.execSync to perform Git operations for repository management. Examples include scripts/capture-base-commit.cjs running git rev-parse and scripts/create-feature-branch.cjs running git status, git branch, and git checkout. Additionally, SKILL.md instructions specify the invocation of external scripts like scripts/dispatch-task-execution.cjs and code-review.cjs (referenced from a sibling skill).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied 'work orders' which drive a three-step automated orchestration workflow.
  • Ingestion points: User conversational input for the 'work order' enters the context in SKILL.md Step 1.
  • Boundary markers: The skill instructs the agent to follow internal logic guides like anti-rationalization.md, but does not implement explicit delimiters for the untrusted work order content itself.
  • Capability inventory: The skill has high capabilities including extensive file system access (writing plans and tasks), execution of shell scripts, and dispatching subagents for implementation.
  • Sanitization: There is no explicit sanitization or content validation performed on the work order before it is used to generate the project plan and subsequent tasks.
  • [DYNAMIC_EXECUTION]: In Step 2 of SKILL.md, the skill dynamically generates task files (.md) containing implementation guidance designed for automated execution by subagents. This involves the programmatic creation of instruction sets that are processed as executable logic in later steps.
  • [EXTERNAL_DOWNLOADS]: The skill instructions and script error messages reference external package execution commands for project setup and updates, specifically npx strikethroo init and npx skills add e0ipso/strikethroo.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 02:44 AM
Security Audit — agent-trust-hub — st-full-workflow