audit-trace
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local shell script 'skills/ship/record-verdict/validate-records.sh' to validate decision records when the corresponding directory exists. This is a deterministic validation pass intended as a core component of the skill's auditing functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled markdown files from multiple documentation paths to extract and validate requirement IDs. While this creates a potential ingestion surface, the risk is mitigated by the use of strict, deterministic regex filters and a 'docs-only' search policy that ignores application source and sensitive system files.
- Ingestion points: Markdown files within the 'docs/specs/', 'docs/architecture/', 'docs/security/', and 'docs/ops/' directories.
- Boundary markers: None explicitly defined in the prompt; the skill relies on structured documentation markers like 'Respects:' and 'Security:' for extraction.
- Capability inventory: The skill utilizes 'grep', 'sed', and 'sh' for text processing and script execution.
- Sanitization: None; extracted IDs are processed as strings and reported directly in the output finding set.
Audit Metadata