woostack-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via the
<goal>parameter which is then used to guide code modifications and GitHub pull request creation, creating a potential surface for indirect prompt injection. - Ingestion points: The
<goal>parameter in the/woostack-changecommand defined inSKILL.mdserves as the primary input for the task. - Boundary markers: The skill requires an admission phase to clarify scope, identify non-goals, and establish acceptance criteria before any mutation occurs. It also references a 'bounded-delivery contract' (
references/bounded-delivery.md) to maintain workflow constraints. - Capability inventory: The skill can perform file modifications, manage Git worktrees and branches, and interact with GitHub for pull request creation and editing. It also supports the Graphite CLI (
gt) for stacked changes. - Sanitization: The process relies on manual clarification and focused verification steps (smoke tests) to validate that changes align with the accepted scope, though automated sanitization of the input string is not explicitly detailed.
Audit Metadata