doubt-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the invocation of external command-line review tools such as Gemini and Codex. It provides comprehensive security instructions to mitigate risks, including environment checks (
which), version verification, and a strict requirement for explicit user authorization before any tool execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted "artifacts" (code or proposals) which constitutes an indirect prompt injection surface. It addresses this risk with a robust evidence chain:
- Ingestion points: Untrusted data enters the cycle via the
ARTIFACTandCONTRACTplaceholders inSKILL.md. - Boundary markers: The skill recommends the use of read-only sandboxes for sub-processes and "hard mental separators" when a degraded self-questioning fallback is used.
- Capability inventory: The skill triggers sub-processes through shell commands (
gemini,codex) and subagent spawning. - Sanitization: It explicitly mandates sanitization via temp files and stdin piping (
echo ... | tool) to prevent shell metacharacter injection, specifically warning against direct string interpolation. - [DYNAMIC_EXECUTION]: To safely interact with external tools, the skill generates temporary markdown files (
/tmp/doubt-prompt.md) containing the review prompt and the untrusted artifact. This controlled file generation is used to pass data to sub-processes via stdin, avoiding unsafe command-line arguments.
Audit Metadata