woostack-harden
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a strict read-only boundary, explicitly prohibiting file writes, commits, issue creation, or implementation-worker dispatch.
- [SAFE]: Instructions mandate explicit user confirmation for every discrepancy found before any modifications are made to the candidate packet.
- [SAFE]: The skill avoids untrusted discovery mechanisms by requiring exact identities for repositories and evidence, reducing the risk of processing malicious or irrelevant data.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data.
- Ingestion points: Specification inputs, repository files, and GitHub issues/PRs (SKILL.md).
- Boundary markers: Explicit requirement to wait for user validation before changing any content (SKILL.md).
- Capability inventory: Limited to read-only repository inspection and selected remote reads (SKILL.md).
- Sanitization: None specified; reliance is placed on human-in-the-loop review for all handback content.
Audit Metadata