maintain-verification-skill
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project source code and data returned from subagents to reconcile documentation with application behavior. This is an inherent attack surface for skills that process external or untrusted data. The instructions mitigate this by specifying that subagents ('T3 child agents') should receive only a self-contained brief and never the parent's full context.
- [COMMAND_EXECUTION]: The skill is intended to execute local 'harness scripts' owned by the verification skill to exercise application features. This execution is confined to testing existing project functionality and is consistent with the skill's primary purpose of verification upkeep.
Audit Metadata