software-engineering-excellence
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository (issue descriptions, project instructions, and code) to drive engineering tasks like implementation and PR creation.
- Ingestion points: Project instructions, relevant code, tests, and issue descriptions (SKILL.md).
- Boundary markers: Instructions require the agent to 'restate its literal ask in one line' and 'keep what was observed apart from what was inferred.'
- Capability inventory: File modification, debugging, refactoring, and opening PRs/issues (SKILL.md).
- Sanitization: No specific technical sanitization is defined, but the 'Investigation discipline' (references/investigation.md) enforces verification of all leads against the source before action.
Audit Metadata