brainstorm-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for the user to install external dependencies. It references a third-party GitHub repository (https://github.com/obra/superpowers) for brainstorming functionality and the author's own repository (https://github.com/FuDesign2008/open-skills) for planning functionality.
- [COMMAND_EXECUTION]: The documentation includes explicit command-line instructions using 'npx skills add' to help users set up the environment. These commands are intended for the user to run manually during installation and are not executed silently by the skill itself.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes data across workflows, specifically taking a file path and a text summary as a handoff payload in reference.md.
- Boundary markers: Uses clear Chinese-language headers (e.g., 【brainstorm-workflow 交接】) to separate handoff data from instructions.
- Capability inventory: The skill has the ability to write files to the file system (specifically design documents) and invoke other skill workflows.
- Sanitization: The workflow includes a mandatory 'user review' step for the written specification before it is passed to the implementation planning stage, providing a human-in-the-loop check.
Audit Metadata