engineering-growth-mentor
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill enforces a Permission Boundary that explicitly prohibits modifying project files or executing state-changing commands without prior approval of a concrete plan.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface through ingestion of repository code and review history.
- Ingestion points: Repository files, diffs, and git history (SKILL.md, Section 2).
- Boundary markers: Explicit instructions to 'obtain explicit approval' of a concrete plan before implementation (SKILL.md, Permission Boundary).
- Capability inventory: File modification and command execution (SKILL.md, Workflow Section 4).
- Sanitization: Reliance on the engineer to review and approve all proposed behaviors and verification commands before they are executed.
- [COMMAND_EXECUTION]: The skill mentions running tests, formatters, and build commands but treats them as potentially mutating and restricts their execution to an approved verification phase, ensuring user oversight.
Audit Metadata