build-by-story
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project plan files, creating an attack surface for indirect instructions to influence agent behavior. \n
- Ingestion points: Reads and parses
tasks.md,requirements.md, anddocs/specs/INDEX.mdas part of the unit derivation process. \n - Boundary markers: Setup step 4 instructions require the agent to record content hashes of global constraints and reference them via paths rather than direct interpolation in sub-agent prompts. \n
- Capability inventory: The skill performs git operations (log, rev-parse, diff) and manages file state (reads/writes) within the
.skills/directory. \n - Sanitization: No explicit string-level sanitization is described; the skill relies on its rigid derivation logic and mandatory human 'unlock' steps to prevent unauthorized execution of embedded instructions.
Audit Metadata