dev
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes a dynamically determined TEST_CMD found in the project root (e.g., from Makefile or package.json). This is a standard and necessary feature for development agents to verify implementation correctness.- [PROMPT_INJECTION]: Contains a potential surface for indirect prompt injection (Category 8) as it processes task descriptions and acceptance criteria from local repository files and interpolates them into sub-agent prompts. \n
- Ingestion points: Reads story and criteria content from plan.md and spec.md files in Phase 1. \n
- Boundary markers: The prompt templates in implementer-prompt.md and reviewer-prompt.md use headers but lack explicit instructions to ignore nested or conflicting instructions within the ingested data. \n
- Capability inventory: The agents have access to powerful tools including Bash, Write, and Edit for repository manipulation. \n
- Sanitization: No sanitization or escaping is performed on the data before interpolation into prompts.- [EXTERNAL_DOWNLOADS]: Sources an environment-specific preflight.sh script from a path determined by a local utility (ship-plugin-root). This is documented as a preamble step for framework-specific initialization and targets the vendor's own tooling.
Audit Metadata