remove-technical-debt
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill uses local project files (e.g., docs/REMOVE-TECHNICAL-DEBT-PLAN.md) to maintain state and guide the agent's logic across sessions. This creates a surface for indirect prompt injection if an attacker modifies these files to include instructions that override the agent's behavior.
- Ingestion points: docs/REMOVE-TECHNICAL-DEBT-PLAN.md, docs/TESTING.md, docs/TECH-DEBT.md, docs/ARCHITECTURE.md, docs/RELIABILITY.md
- Boundary markers: None identified in the prompt templates or instructions
- Capability inventory: Read/write access to the docs/ directory, suggestion of shell commands to the user
- Sanitization: No explicit sanitization or validation of the content read from the docs/ directory is defined- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to recommend the command 'npx skills add wondelai/skills/ --global' when a dependent skill is missing. This encourages the user to download and execute code from an unverified external repository.
Audit Metadata