st-full-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Multiple scripts within the skill utilize
child_process.execSyncto perform Git operations for repository management. Examples includescripts/capture-base-commit.cjsrunninggit rev-parseandscripts/create-feature-branch.cjsrunninggit status,git branch, andgit checkout. Additionally,SKILL.mdinstructions specify the invocation of external scripts likescripts/dispatch-task-execution.cjsandcode-review.cjs(referenced from a sibling skill). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied 'work orders' which drive a three-step automated orchestration workflow.
- Ingestion points: User conversational input for the 'work order' enters the context in
SKILL.mdStep 1. - Boundary markers: The skill instructs the agent to follow internal logic guides like
anti-rationalization.md, but does not implement explicit delimiters for the untrusted work order content itself. - Capability inventory: The skill has high capabilities including extensive file system access (writing plans and tasks), execution of shell scripts, and dispatching subagents for implementation.
- Sanitization: There is no explicit sanitization or content validation performed on the work order before it is used to generate the project plan and subsequent tasks.
- [DYNAMIC_EXECUTION]: In Step 2 of
SKILL.md, the skill dynamically generates task files (.md) containing implementation guidance designed for automated execution by subagents. This involves the programmatic creation of instruction sets that are processed as executable logic in later steps. - [EXTERNAL_DOWNLOADS]: The skill instructions and script error messages reference external package execution commands for project setup and updates, specifically
npx strikethroo initandnpx skills add e0ipso/strikethroo.
Audit Metadata