develop
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands for legitimate development tasks like git branch management, PR creation, and running test suites with Nx. These are standard operations for a developer agent.
- [DYNAMIC_EXECUTION]: The skill utilizes local Node.js scripts (change-log.js, doc-id.js) to handle complex file updates and ID generation, which is a safer alternative to raw text manipulation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided markdown files (stories and tasks) as instructions. While this presents an attack surface, the risk is inherent to the agent's function as a task executor and is mitigated by the structured nature of the workflow and internal validation gates.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration were detected. All scripts and operations align with the intended purpose of assisting in software development.
Audit Metadata