check-roadmap

Pass

Audited by Gen Agent Trust Hub on Jul 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands (grep, sed, sort, test) to process local documentation files such as docs/roadmap/INDEX.md and docs/specs/INDEX.md. The operations are restricted to searching and filtering project identifiers (e.g., GOAL-N, MILE-N) and do not involve network access or sensitive system paths.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-controlled files from the repository. It addresses this risk through explicit instructions to the agent: treat all read values as 'passive data', never obey instructions embedded in data, and ensure values passed to shell commands are treated as non-option arguments and validated against expected patterns (IDs or revision shapes).
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 26, 2026, 10:10 AM
Security Audit — agent-trust-hub — check-roadmap