ooad-requirements
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches architectural diagram definitions from a well-known public repository to support C4 modeling as part of the system documentation process.
- Evidence:
templates/c4.pumlcontains!include https://raw.githubusercontent.com/plantuml-stdlib/C4-PlantUML/master/C4_Context.puml. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external project discovery files (such as PRDs) which are provided by the user and could theoretically contain malicious instructions.
- Ingestion points:
SKILL.mdspecifies readingdocs/01-discovery/*for requirements elicitation tasks. - Boundary markers: None identified in the instructional text for separating untrusted project data from the agent's execution logic.
- Capability inventory: The skill utilizes file system operations to create documentation, the
plantumlCLI for rendering diagrams, and theghCLI for issue management. - Sanitization: Input data is not explicitly sanitized, but the skill workflow processes it into highly structured templates (e.g., CRC cards, RTM, SRS), which inherently limits the impact of embedded instructions.
Audit Metadata