025-quality-attribute-discovery
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were identified. The skill's instructions are restricted to identifying quality attributes based on existing analytical evidence and strictly prohibit making architectural decisions or creating ADRs.
- [NO_CODE]: The skill consists entirely of static Markdown documentation and YAML metadata. It does not include any executable scripts, binary files, or external software dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing external inputs such as problem frames, root-cause findings, and assumptions. While this represents a theoretical ingestion surface for indirect prompt injection, the skill lacks any dangerous capabilities (e.g., file writes, network requests, or tool execution) that could be leveraged. The instructions include explicit safeguards to ground all findings in gathered evidence and flag ambiguities rather than inventing content.
- Ingestion points: Reads upstream evidence from problem frames, root-cause findings, and context maps (SKILL.md, Workflow Step 1).
- Boundary markers: Includes constraints to "ground each candidate quality attribute in evidence" and "flag the gap for a clarifying question" (SKILL.md, Constraints).
- Capability inventory: None. No tools are specified in frontmatter, and no scripts are included.
- Sanitization: Not applicable as the skill produces only text-based discovery reports.
Audit Metadata