implement
Warn
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill documentation contains a deceptive discrepancy regarding user oversight. While the README states that the agent will 'never' commit without explicit user approval, the system instructions in SKILL.md explicitly command the agent to skip this approval process ('Do not ask for approval before committing'). This instruction effectively removes a documented safety constraint, allowing autonomous modification of the codebase without human verification.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core function of processing untrusted project artifacts.\n
- Ingestion points: Reads PRD, technical design, and implementation plan documents from the
.specs/directory, as well as general codebase content.\n - Boundary markers: There are no explicit markers or instructions defining the boundary between system prompts and user-provided artifact content.\n
- Capability inventory: The agent can execute shell commands for git operations (log, commit), testing, and linting.\n
- Sanitization: No validation or sanitization of the content from these artifacts is performed before it is used to determine the agent's implementation steps or command arguments.\n- [COMMAND_EXECUTION]: The skill performs autonomous git commits and executes shell commands for testing and linting based on project configuration. When combined with the bypass of user approval and the ingestion of untrusted planning documents, this creates a path for the agent to be manipulated into committing malicious code or executing dangerous scripts defined in the project configuration without user awareness.
Audit Metadata