create-control-manifest
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from local Markdown files such as Architecture Decision Records (ADRs) and technical preference documents. This creates a surface where content within those files could theoretically attempt to influence the agent's summary or the generated manifest. However, the ingestion is confined to trusted local project paths, and the skill's logic focuses on extraction rather than execution of instructions.
- Ingestion points: Reads files from
docs/architecture/,.claude/docs/, anddocs/engine-reference/. - Boundary markers: Content is parsed by section headers; explicit delimiters or instructions to ignore embedded commands are not specified for the raw file content.
- Capability inventory: The skill uses
Read,Glob,Grep, andWritetools; no network or arbitrary shell execution tools are enabled. - Sanitization: The agent performs extraction based on natural language search and pattern matching rather than executing the content.
Audit Metadata