discovery
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local CLI tool (
sam_schema/cli.py) using theuvrunner to retrieve backlog item details when initialized with a selector. This is a functional requirement for its purpose and targets a script within the plugin's own directory structure. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface area for indirect prompt injection as it ingests untrusted content from user requests and backlog items to generate documentation artifacts.
- Ingestion points: User-provided problem statements and data retrieved from the
backlog viewcommand described inSKILL.md. - Boundary markers: The skill implements a triage process to filter out implementation-specific ('HOW') content, though it lacks strict data delimiters for CLI output.
- Capability inventory: The skill uses the
artifact_registerMCP call to create files on the system. - Sanitization: The process includes a mandatory 'Human Touchpoint Gate' that requires the user to manually confirm the discovery document's accuracy before the workflow proceeds.
Audit Metadata