scope-check
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a project management workflow to detect scope creep. It primarily involves reading local documentation in directories like
design/andproduction/and comparing it to the current codebase. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to rungit logcommands for identifying recent commits and changes. This usage is focused on data gathering for the scope analysis report. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's documentation and code comments which could theoretically influence agent behavior.
- Ingestion points: Reads project documentation files in
design/andproduction/and scans the codebase forTODOorFIXMEcomments. - Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions embedded within the analyzed files.
- Capability inventory: The skill uses
Read,Glob,Grep, andBash. It does not have network access or permissions to write to the filesystem. - Sanitization: There is no mention of sanitizing or escaping content retrieved from external files before it is processed or reported.
Audit Metadata