herdr-parallel-dev
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface by processing untrusted data from the repository to influence agent behavior.
- Ingestion points: The workflow reads configuration and instructions from
git config,AGENTS.md,CONTRIBUTING.md, andREADME.md(Step 1), as well as content fromgit logandgit diff(Step 6 and Step 8). - Boundary markers: The prompt template in Step 4 provides a structured brief but lacks explicit instructions or delimiters to ignore embedded commands within the ingested repository data.
- Capability inventory: The skill utilizes
git,herdr, andgh(GitHub CLI) for file system manipulation, agent lifecycle management, and forge orchestration (PR creation/merging). - Sanitization: There is no evidence of escaping or filtering the extracted repository content before it is interpolated into sub-agent prompts.
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands (
git,gh,herdr) and executes a local verification script (scripts/verify-worktrees.sh) to manage the development environment. These commands are necessary for the skill's function as a development orchestrator and target the repository's working environment.
Audit Metadata