implement
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The workflow explicitly mandates human authorization for high-risk actions such as code commits, repository pushes, PR creation, and destructive commands. These 'Human and external-action gates' ensure the AI agent does not perform sensitive operations autonomously without user consent.
- [SAFE]: The skill incorporates a risk-proportional assurance model (Lean, Standard, Guarded). High-risk 'Guarded' implementations require parallel spec and standards reviews by specialists in security, data, and performance, providing a robust defense-in-depth posture.
- [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it ingests user-provided plans and approved conversational plans (SKILL.md, Step 0).
- Ingestion points: External plan files (XML/Markdown) and conversational history are loaded to define tasks.
- Boundary markers: The process uses 'Plan schema: 2' for strict task validation and implements 'checkpoint:verify' and 'checkpoint:decide' as human-in-the-loop delimiters.
- Capability inventory: The skill has capabilities to delegate tasks to sub-agents (e.g., implementer, fixer), write to the file system, and run production builds or closeout verification sets (SKILL.md, Steps 3, 5, 6).
- Sanitization: Validation of task 'kinds', canonical drift checks, and fingerprinting of attributable files help ensure implementation integrity against unauthorized changes.
Audit Metadata