do-execute-review-fix
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains an "Autonomous Execution Policy" that explicitly instructs the agent to bypass user interaction. Phrases like "No user interaction permitted at any point", "NEVER pause, stop, or wait for user input", and "NEVER ask the user questions" are used to override standard agent behavior and suppress user confirmation steps.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from multiple sources including fix task files, PRDs, and TechSpecs. Ingestion points: Fix task files provided by the user and existing PRD/TechSpec documents in the project root. Boundary markers: The instructions lack requirements for using delimiters or boundary markers when reading these external files. Capability inventory: The skill uses tools to read, edit, and write files, and executes shell commands for project testing and static analysis. Sanitization: There are no instructions for sanitizing or validating the content of the ingested files before processing them.
- [COMMAND_EXECUTION]: The skill executes shell commands for testing and static analysis (Steps 3 and 4). These commands are resolved dynamically from project-controlled reference files rather than using a static whitelist.
- [DYNAMIC_EXECUTION]: Runtime configuration and project-specific commands are resolved at execution time based on the detected environment and workspace files, which introduces a dependency on the integrity of the project's own configuration metadata.
Audit Metadata