build-piece
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external project documentation that could influence its logic or script execution.
- Ingestion points: Processes content from the 'masterplan', 'AGENTS.md', and piece-specific 'Under the hood' notes.
- Boundary markers: There are no defined boundary markers or instructions to ignore embedded commands within these ingested files.
- Capability inventory: The skill can execute multiple scripts ('piece-labels.sh', 'quality.py', 'upload-piece.py', 'gate.py') and perform Git operations including branch creation and PR updates.
- Sanitization: No sanitization or validation is applied to the documentation content before it is used to guide the build process.
- [COMMAND_EXECUTION]: The skill logic relies on the execution of several shell and Python scripts.
- Evidence: Invokes 'piece-labels.sh', 'quality.py', 'check-sensitive-areas.sh', 'upload-piece.py', 'gate.py', and 'trued-mark.sh'.
- [DYNAMIC_EXECUTION]: The skill performs runtime execution of Python and Shell scripts to manage the build lifecycle.
Audit Metadata