sdlc-protocol
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a utility script
scripts/allocate-ports.shused to calculate and output non-overlapping port configurations for parallel development environments. The script uses standard system utilities (bash,git,printf) and operates within the local repository context to prevent network port collisions. - [EXTERNAL_DOWNLOADS]: The documentation references the
ao(Agent Orchestrator) command-line interface, which is a platform tool used for spawning sub-agents and monitoring asynchronous tasks. No external code is downloaded or executed from untrusted remote sources. - [PROMPT_INJECTION]: The skill implements a 'Router' pattern where the agent processes user-provided feature specifications to generate sub-task instructions. This ingestion of untrusted data represents an indirect prompt injection surface. However, the protocol mitigates this through a structured 'Wave Model' and a mandatory integration review phase where the agent (acting as the Router) validates all changes and ensures sub-tasks adhere to fixed contract boundaries.
Audit Metadata