woostack-sweep
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages an attack surface where untrusted data from GitHub PRs is processed, but it mitigates risks through explicit behavioral constraints.\n
- Ingestion points: Untrusted data enters the agent's context through PR text, reviews, and thread comments as specified in SKILL.md.\n
- Boundary markers: The skill explicitly labels this external data as 'untrusted evidence' and forbids it from influencing core operations.\n
- Capability inventory: The agent can execute git-related stack commands (gt restack), manage worktrees, and invoke sub-skills for review and addressing comments.\n
- Sanitization: The skill utilizes instructional guardrails to treat external input as non-authoritative for security-sensitive decisions.\n- [SAFE]: The workflow uses a bottom-up dependency order and requires deterministic binding of branches to PRs, preventing unauthorized scope expansion or branch manipulation.\n- [DYNAMIC_EXECUTION]: The repository contains local Python and shell scripts (scripts/tests/) used for verification of the skill's instructions. These scripts are safe as they only perform regex-based static analysis on local markdown files and do not download or execute remote code.\n- [COMMAND_EXECUTION]: Command execution is limited to specific Graphite (gt) and Git tools required for stack management, and all mutations are preceded by fresh state read-backs and verification of task contracts.
Audit Metadata