woostack-build
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes data from external project management tools. \n
- Ingestion points: Reads project descriptions, issue titles, and README sections as documented in github-context.md, linear-context.md, and plane-context.md.\n
- Boundary markers: Employs specific markers such as
<!-- woostack-spec-start -->and<!-- woostack-spec-end -->to delimit managed artifacts.\n - Capability inventory: Utilizes the
ghCLI and platform-specific Model Context Protocol (MCP) tools for repository and project interactions.\n - Sanitization: The skill instructions explicitly mandate that the agent must treat human-authored external content as untrusted evidence, reducing the risk of accidental instruction execution from these sources.\n- [COMMAND_EXECUTION]: A shell script for testing (
scripts/tests/test-progressive-disclosure.sh) performs basic filesystem operations likecatandwcto verify skill file integrity. These operations are benign, standard for development testing, and confined to the local workspace.
Audit Metadata