forge
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by explicitly granting priority to instructions found within the repository being worked on.
- Ingestion points: The 'Protocol Start Checklist' directs the agent to read and follow the managed protocol block in repo-resident AGENTS.md and CLAUDE.md files.
- Boundary markers: No specific boundary markers, delimiters, or isolation instructions are provided for this external content.
- Capability inventory: The skill possesses the capability to write various repository files (PRDs, slices, decision logs) and execute shell commands through the 'wiki' CLI tool and 'bun' runner.
- Sanitization: The skill contains no sanitization logic for these external instructions and explicitly states that 'If they conflict, the repo instruction file wins,' which allows a malicious file to hijack the agent's behavior.
- [COMMAND_EXECUTION]: The skill includes instructions to execute shell commands for synchronizing local build artifacts.
- Evidence: The 'Local Refresh Rule' requires the agent to run 'bun run sync:local' and 'bun run sync:local -- --audit' to update local scripts such as 'scripts/sync-local.ts'.
Audit Metadata