task
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed for the planning phase and contains explicit invariants that forbid code implementation or automated execution. By focusing solely on document creation and requiring a stop for user review, the skill maintains a strong human-in-the-loop security posture.
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection because it ingests project files during the research phase and incorporates that content into generated documents.
- Ingestion points: The skill reads AGENTS.md, LEARNINGS.md, and various files from the codebase during research (SKILL.md).
- Boundary markers: There are no specific delimiters or instructions used to wrap or isolate content read from external project files.
- Capability inventory: The skill is restricted to file system write operations for documentation purposes in docs/task/ and TASKS.md.
- Sanitization: Content retrieved from the codebase is included in the task document without specific sanitization for embedded instructions.
- Mitigation: The risk of injection-based exploitation is mitigated by the mandatory human review invariant and the lack of implementation or automation capabilities within the skill's scope.
Audit Metadata