sphere-feature-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell commands via the project's Makefile targets, such as 'make gen/proto', 'make gen/wire', 'make test', and 'make check'. These commands are standard operations for code generation, dependency injection wiring, and running automated test suites within the go-sphere development environment.
- [INDIRECT_PROMPT_INJECTION]: The skill architecture depends on reading and adhering to local project configuration files, including '.sphere/layout.json', 'AGENTS.md', and 'docs/LAYOUT_CONTRACT.md'. These files are treated as authoritative sources that define file ownership and override the skill's generic instructions.
- Ingestion points: Project configuration files ('.sphere/layout.json', 'AGENTS.md', 'docs/LAYOUT_CONTRACT.md') and source files (Protobuf contracts and Ent schemas).
- Boundary markers: The skill does not implement explicit boundary markers; instead, it explicitly delegates trust to the project-local documentation and layout contract.
- Capability inventory: The skill possesses file modification capabilities and the ability to execute shell commands via Makefile targets.
- Sanitization: There is no evidence of sanitization for the ingested metadata content; the agent is instructed to follow the project-specific layout contract directly.
- [DYNAMIC_EXECUTION]: The workflow leverages automated code generation tools (e.g., protoc plugins and the Ent framework) to produce Go source code and API documentation from handwritten definitions. These generated artifacts are then compiled and executed during the 'make test' and 'make build' phases, which is a standard procedure in code-generation-heavy architectures like go-sphere.
Audit Metadata