goal-driven-queue
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from task cards and external Jira issues, which could potentially contain malicious instructions aimed at the child engines.
- Ingestion points: Task cards located at ".goal-driven/queues//.md" and Jira issue content.
- Boundary markers: Uses structured Markdown headers and specific fields (e.g., "Goal Condition", "Frozen Decisions") to delimit data.
- Capability inventory: Performs file system operations (read/write), executes shell commands via "spawn" in "scripts/render-html.mjs", and dispatches tasks to other AI agent skills.
- Sanitization: The "scripts/render-html.mjs" script uses an "escapeHtml" function when generating HTML views from Markdown content.
- [COMMAND_EXECUTION]: The "scripts/render-html.mjs" script uses the "spawn" function to open generated HTML files in the system's default browser.
- Evidence: The "openInBrowser" function in "scripts/render-html.mjs" executes platform-specific commands ("open", "cmd /c start", "xdg-open") with the file path as an argument.
- Mitigation: The script includes a security check ("isUnderRoot") to ensure that only files within the authorized queue directory can be opened, preventing arbitrary file access.
Audit Metadata