workflow-project-intake
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied requirements and repository content to generate project artifacts used by downstream agents.
- Ingestion points: User conversation input and local repository files via the repo_root parameter.
- Boundary markers: Absent; the skill does not define specific delimiters for user-provided content when writing to the proposal.md or tasks.md files.
- Capability inventory: The skill performs file system writes and routes tasks to execution-heavy workflows including Supabase, Stripe, and Vercel.
- Sanitization: Instructions include redacting secrets from logs, but there is no explicit sanitization for natural language prompt injection within the generated markdown artifacts.
- [COMMAND_EXECUTION]: The skill manages project state and environment configuration through local file operations and tool invocations.
- Evidence: Mentions execution of tool-hooks-doctor and management of artifacts in a local runs/ or openspec/ directory.
- Mitigation: Incorporates a mandatory Checkpoint Protocol requiring explicit user confirmation before any write operations or actions with external side effects.
- [PERSISTENCE]: The skill supports the installation of hooks for automated improvements.
- Evidence: The skill instructions mention using tool-hooks-doctor to check for and potentially install project-level evolution hooks.
- Mitigation: The installation process is non-blocking and subject to the skill's mandatory user approval gate.
Audit Metadata