ooad-build
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project requirements and architecture documentation, which creates a surface for indirect prompt injection if those documents contain adversarial instructions.
- Ingestion points: Project documentation located in
docs/02-requirements/anddocs/03-architecture/are used as primary inputs for code implementation and task management. - Boundary markers: The skill enforces structural boundaries through the "Clean 4 Layers" architecture and strict Test-Driven Development (TDD) cycles, which separate business logic from external frameworks.
- Capability inventory: The skill has the capability to write source code files, execute shell commands for testing suites (
pytest,npm test,go test), and interact with the GitHub API via theghCLI tool. - Sanitization: There are no explicit instructions or automated mechanisms defined within the skill to sanitize or validate the content of ingested documents before processing.
- [EXTERNAL_DOWNLOADS]: The skill configuration for rendering C4 diagrams includes a remote fetch for a PlantUML library.
- Evidence: The file
templates/c4.pumlincludes the directive!include https://raw.githubusercontent.com/plantuml-stdlib/C4-PlantUML/master/C4_Context.puml. - Context: This is a standard and well-recognized community library for creating C4 model diagrams.
- [COMMAND_EXECUTION]: The skill instructions and templates facilitate the execution of developer tools and shell commands to manage the software lifecycle.
- Evidence:
SKILL.mdandtemplates/test-plan.mdinstruct the agent to runpytest,npm test,go test, andbehave.templates/issue-tracker-github.mdprovides patterns for using theghCLI for issue and PR management.
Audit Metadata