scope-check

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements a project management workflow to detect scope creep. It primarily involves reading local documentation in directories like design/ and production/ and comparing it to the current codebase.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run git log commands for identifying recent commits and changes. This usage is focused on data gathering for the scope analysis report.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's documentation and code comments which could theoretically influence agent behavior.
  • Ingestion points: Reads project documentation files in design/ and production/ and scans the codebase for TODO or FIXME comments.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions embedded within the analyzed files.
  • Capability inventory: The skill uses Read, Glob, Grep, and Bash. It does not have network access or permissions to write to the filesystem.
  • Sanitization: There is no mention of sanitizing or escaping content retrieved from external files before it is processed or reported.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 02:47 PM