roadmap
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a structured logic for reading authoritative inputs and generating output markdown files. The behavior is well-defined and constrained to the local file system within specified directory structures.
- [DATA_EXPOSURE]: The skill accesses local files like
seed.md,decisions.md, andproposal.mdand writes toroadmap.mdandroadmap-feedback.md. These operations are limited to the workspace and do not involve credential harvesting or network exfiltration. - [COMMAND_EXECUTION]: The skill references an internal tool pattern
/emit-pending-decisionsto be used when inputs are ambiguous. This appears to be a legitimate project-specific integration for managing decision bundles rather than an attempt at arbitrary shell execution. - [PROMPT_INJECTION]: While the skill uses specific formatting for its output (e.g.,
Outcome: DONE), there are no instructions aimed at overriding agent safety guidelines or bypassing system constraints.
Audit Metadata